Suricata DNS Resource Name Compression Vulnerability Leading to Log Resource Starvation

A vulnerability in Suricata's DNS handling prior to version 7.0.8 allows DNS resource name compression to create small DNS messages with excessively large hostnames. This can be expensive to decode and result in oversized DNS log entries. Although there are limits to prevent this, they were not stringent enough. The issue has been fixed in Suricata version 7.0.8.

Impact

The vulnerability can cause resource exhaustion by generating large DNS log records, which can be detrimental to systems with limited logging resources.

Reproduction

The vulnerability can be reproduced by sending DNS messages that utilize compression to create large hostnames, exceeding the normal length limits. This can be done by crafting DNS packets that compress pointers to long names, effectively creating a small packet with a large hostname that Suricata will decode and log.

Remediation

Users can upgrade to Suricata version 7.0.8 or later to address this vulnerability.