CVE-2024-55605: Oisf Suricata Buffer Overflow Vulnerability

CVE-2024-55605 Overview

CVE-2024-55605 is a stack overflow vulnerability in Suricata, an open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine maintained by the Open Information Security Foundation (OISF). Versions prior to 7.0.8 fail to bound input sizes passed to several rule transform functions. A sufficiently large input buffer supplied to to_lowercase, to_uppercase, strip_whitespace, compress_whitespace, dotprefix, header_lowercase, strip_pseudo_headers, url_decode, or xor triggers a stack overflow and crashes the Suricata process. OISF resolved the issue in Suricata 7.0.8.

Critical Impact
Remote attackers can crash Suricata sensors over the network without authentication, disabling network detection and prevention coverage during an active intrusion.

Affected Products

OISF Suricata versions prior to 7.0.8
Deployments using rules with any of the affected transforms (to_lowercase, to_uppercase, strip_whitespace, compress_whitespace, dotprefix, header_lowercase, strip_pseudo_headers, url_decode, xor)
Network sensors and inline IPS appliances running vulnerable Suricata builds

Discovery Timeline

2025-01-06 - CVE-2024-55605 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55605

Vulnerability Analysis

Suricata rule language supports transforms that normalize buffers before content matching. Each affected transform allocates working storage on the stack proportional to the size of the input buffer. When an attacker delivers traffic that produces an oversized buffer for one of these transforms, the allocation exceeds the thread stack region and corrupts adjacent memory or triggers a guard-page fault. The Suricata worker thread terminates, ending packet inspection.

The weakness is tracked as an uncontrolled resource consumption issue [CWE-400]. Impact is limited to availability: confidentiality and integrity are not affected. However, the loss of an IDS or inline IPS sensor removes a control that other layers rely on for detection and blocking.

Root Cause

The transform implementations use fixed stack-based buffers or variable-length arrays sized from attacker-controlled input length. No upper bound is enforced before the copy or transformation operation. Rules that reference the affected transforms therefore expose Suricata to input-driven stack exhaustion whenever matching traffic is processed.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends crafted network traffic that Suricata inspects against a ruleset containing any vulnerable transform. Because Suricata processes traffic passively or inline, no interaction with the target host is required. A single packet stream can crash the analyzer thread and disable coverage until the process restarts. Repeated delivery keeps the sensor offline. Refer to the OISF GitHub Security Advisory GHSA-x2hr-33vp-w289 and the Open Information Security Foundation issue tracker entry 7229 for maintainer analysis.

Detection Methods for CVE-2024-55605

Indicators of Compromise

Unexpected Suricata process crashes, segmentation faults, or worker thread restarts logged in suricata.log or system journal.
Gaps in eve.json output or a sudden drop in stats.log packet counters correlated with specific traffic flows.
Core dumps referencing transform functions such as to_lowercase, url_decode, or xor in the crash backtrace.

Detection Strategies

Inventory the running Suricata version on every sensor and flag any build earlier than 7.0.8.
Audit active rulesets for use of the affected transforms and correlate rule hits with sensor stability metrics.
Alert on Suricata service restarts and abnormal exit codes through host monitoring.

Monitoring Recommendations

Ship Suricata process metrics, stats counters, and system logs to a central analytics platform for continuous availability monitoring.
Track packet drop and capture.kernel_drops counters, which rise when workers die and queues back up.
Configure health checks that fail closed when a sensor stops producing eve.json events for a defined interval.

How to Mitigate CVE-2024-55605

Immediate Actions Required

Upgrade all Suricata deployments to version 7.0.8 or later.
Restart the Suricata service after upgrade and verify the reported version with suricata --build-info.
Where immediate patching is not possible, temporarily remove or disable rules that invoke the affected transforms.

Patch Information

OISF released Suricata 7.0.8 to address the stack overflow. Distribution packages tracking the 7.0.x branch have incorporated the fix. Details, backport guidance, and the commit range are available in the OISF GitHub Security Advisory GHSA-x2hr-33vp-w289.

Workarounds

Remove custom or vendor rules that reference to_lowercase, to_uppercase, strip_whitespace, compress_whitespace, dotprefix, header_lowercase, strip_pseudo_headers, url_decode, or xor transforms until the upgrade is applied.
Deploy redundant sensors so that a crash on one node does not eliminate detection coverage on a monitored segment.
Restrict management-plane access to Suricata hosts and enable automatic service restart via systemd or the host supervisor to reduce downtime after a crash.

bash

# Verify Suricata version and confirm remediation
suricata --build-info | grep -i "this is suricata version"

# Example systemd override to auto-restart Suricata workers
# /etc/systemd/system/suricata.service.d/override.conf
[Service]
Restart=always
RestartSec=5s