Suricata Heap Overflow Vulnerability in Alert Logging Prior to 7.0.13 and 8.0.2

A heap buffer overflow vulnerability has been identified in Suricata, a network IDS, IPS, and NSM engine, prior to versions 7.0.13 and 8.0.2. This vulnerability occurs when logging verdicts in 'eve.alert' and 'eve.drop' records, leading to crashes. Exploitation requires the per-packet alert queue to be filled with alerts, followed by a 'pass' rule.

Impact

Exploitation of this vulnerability causes a heap buffer overflow, leading to crashes.

Remediation

Users can upgrade to Suricata versions 7.0.13 or 8.0.2 to address this vulnerability. The 'verdict' option, which is disabled by default, can be turned off if it has been enabled. Additionally, increasing the alert queue size in the 'suricata.yaml' configuration file can reduce the likelihood of this issue occurring.