CVE-2024-55628: Oisf Suricata DNS DoS Vulnerability

CVE-2024-55628 Overview

CVE-2024-55628 is a resource exhaustion vulnerability [CWE-405] in Suricata, the open-source Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine maintained by the Open Information Security Foundation (OISF). Versions prior to 7.0.8 mishandle DNS resource name decompression. An attacker can craft small DNS messages that decompress into very large hostnames, producing oversized DNS log records and consuming excessive CPU during decoding. The existing decoding limits were too generous to prevent abuse. The issue is fixed in Suricata 7.0.8.

Critical Impact
Remote, unauthenticated attackers can degrade Suricata sensor performance and inflate log storage by sending compact DNS traffic that expands into multi-kilobyte hostnames, impacting detection capability across monitored networks.

Affected Products

OISF Suricata versions prior to 7.0.8
Deployments running Suricata as an IDS/IPS sensor with DNS protocol parsing enabled
Suricata-based network security monitoring stacks ingesting EVE JSON DNS logs

Discovery Timeline

2025-01-06 - CVE-2024-55628 published to the National Vulnerability Database (NVD)
2025-03-31 - Last updated in NVD database

Technical Details for CVE-2024-55628

Vulnerability Analysis

The vulnerability resides in Suricata's DNS parser, specifically in the resource name decompression logic implemented in rust/src/dns/dns.rs. DNS uses a compression scheme (RFC 1035 section 4.1.4) where labels can be replaced by pointers to earlier occurrences in the same message. A small, well-crafted message containing nested pointers and long labels can expand into a hostname many kilobytes in length. Suricata logged the fully expanded name into its EVE JSON output, producing oversized records and consuming significant CPU per packet. Because Suricata processes traffic at line rate, repeated abusive DNS payloads can starve the sensor of processing time and bloat downstream log pipelines.

Root Cause

The parser enforced upper bounds on decompressed names, but those bounds were too permissive to prevent algorithmic amplification. The fix introduces a hard cap of 1025 characters for resource names, additional safeguards against infinite pointer loops, and a limit on the maximum number of labels traversed. New parse states NameTooLong, InfiniteLoop, and TooManyLabels were added to the Rust DNS implementation to surface recoverable parse errors as events instead of silently consuming resources.

Attack Vector

Exploitation requires only the ability to send DNS traffic that traverses a Suricata sensor. Network position is sufficient — the attacker does not need credentials or interaction with any target host. An adversary can deliver crafted DNS responses or queries (for example, by inducing victim resolvers to query an attacker-controlled authoritative server) to force Suricata to decode pathological names. The result is CPU exhaustion on the sensor and storage exhaustion in any SIEM or log lake consuming Suricata EVE output.

text

# Z flag (reserved) not 0
alert dns any any -> any any (msg:"SURICATA DNS Z flag set"; app-layer-event:dns.z_flag_set; classtype:protocol-command-decode; sid:2240006; rev:2;)
alert dns any any -> any any (msg:"SURICATA DNS Invalid opcode"; app-layer-event:dns.invalid_opcode; classtype:protocol-command-decode; sid:2240007; rev:1;)

# A resource name was too long (over 1025 chars)
alert dns any any -> any any (msg:"SURICATA DNS Name too long"; app-layer-event:dns.name_too_long; classtype:protocol-command-decode; sid:224008; rev:1;)

# An infinite loop was found while decoding a DNS resource name.
alert dns any any -> any any (msg:"SURICATA DNS Infinite loop"; app-layer-event:dns.infinite_loop; classtype:protocol-command-decode; sid:224009; rev:1;)

# Suricata's maximum number of DNS name labels was reached while parsing a resource name.
alert dns any any -> any any (msg:"SURICATA DNS Too many labels"; app-layer-event:dns.too_many_labels; classtype:protocol-command-decode; sid:224010; rev:1;)

Source: Suricata Commit 19cf0f81 — adds rule signatures for the new recoverable parse error events.

Detection Methods for CVE-2024-55628

Indicators of Compromise

DNS log records with rrname_truncated, mname_truncated, or rname_truncated set to true in Suricata EVE JSON output after upgrading to 7.0.8
Triggered alerts for app-layer-event:dns.name_too_long, dns.infinite_loop, or dns.too_many_labels (SIDs 224008–224010)
Sudden growth in EVE JSON DNS record size or sensor CPU utilization correlated with specific source IPs or authoritative servers

Detection Strategies

Deploy the updated dns-events.rules shipped with Suricata 7.0.8 to surface malformed DNS parsing events
Baseline normal DNS record size in your log pipeline and alert on anomalous EVE entries exceeding the 1025-character truncation threshold
Correlate truncation flags with source endpoints to identify victims being directed to abusive authoritative DNS servers

Monitoring Recommendations

Track Suricata worker thread CPU utilization and packet drop counters for sustained anomalies
Forward EVE JSON DNS events to a centralized data lake and apply queries for the new truncation fields
Monitor outbound DNS to rarely seen authoritative servers, which is a common vector for delivering crafted DNS responses

How to Mitigate CVE-2024-55628

Immediate Actions Required

Upgrade all Suricata sensors to version 7.0.8 or later as the primary remediation
Inventory IDS/IPS deployments to confirm version coverage across distributed sensors and managed appliances
Validate that vendor-packaged Suricata distributions (security appliances, NDR products) have incorporated the fix

Patch Information

The fix is delivered in Suricata 7.0.8 via three commits: 3a5671739f truncates resource names larger than 1025 characters and introduces the DNSName type; 37f4c52b22 adds *_truncated boolean flags to EVE JSON DNS output; and 19cf0f8133 introduces recoverable parse error events. See the GHSA-96w4-jqwf-qx2j advisory and OISF Issue #7280 for full details.

Workarounds

If immediate upgrade is not feasible, disable the DNS application layer parser in suricata.yaml to remove the vulnerable code path, accepting the loss of DNS visibility
Apply upstream rate limiting or DNS filtering at perimeter resolvers to reduce exposure to crafted authoritative responses
Increase sensor CPU headroom and EVE log rotation frequency to limit the operational blast radius until patching is complete

bash

# Disable DNS app-layer parsing in suricata.yaml as a temporary mitigation
app-layer:
  protocols:
    dns:
      tcp:
        enabled: no
      udp:
        enabled: no

# Verify installed Suricata version is 7.0.8 or later
suricata --build-info | grep -i version