Suricata Stack Overflow Vulnerability in Lua Scripts

A stack overflow vulnerability has been identified in Suricata, a network IDS, IPS, and NSM engine, prior to versions 7.0.13 and 8.0.2. The issue arises when large buffers are processed in Lua scripts, potentially leading to a stack overflow. This vulnerability affects users of Lua rules and output scripts that handle large buffers, including scenarios where a rule passes a large buffer to a Lua script.

Impact

Exploiting this vulnerability can cause a stack overflow, leading to a crash or undefined behavior in the application.

Remediation

Users can upgrade to Suricata versions 7.0.13 or 8.0.2, or disable Lua rules and output scripts. If disabling Lua is not an option, ensure that the 'stream.depth.reassembly' and 'response-body-limit' settings are configured to less than half the stack size.