CVE-2024-28870

What it actually does

When parsing an overly long SSH banner, Suricata consumes excessive CPU resources and generates excessive logging volume in alert records.

Why it matters to the business

Attackers can disrupt network monitoring by overwhelming the Suricata engine, potentially leading to degraded security visibility and increased operational costs from log management.

How an attack unfolds

An attacker sends a network packet containing an SSH banner that exceeds expected length limits to a monitored network segment. Suricata's parser processes this banner, triggering high CPU usage and voluminous alert logging, which can lead to resource exhaustion.

How to fix it

Upgrade Suricata to version 6.0.17 or 7.0.4 or later to address the banner parsing issue.

How to confirm the fix worked

Verify the installed version is at least 6.0.17 or 7.0.4. Test by sending a long SSH banner and confirming no excessive resource use.

Typical attack path

1. Identify a network monitored by Suricata
2. Craft a TCP packet with an excessively long SSH banner in the initial handshake
3. Send the packet to trigger parsing
4. Observe resource consumption and logging spike

How to detect it

Look in Suricata logs for alerts related to SSH banner parsing or high volume of SSH-related events. Monitor system metrics for sudden CPU spikes on Suricata processes.

What your security team should do

• Prioritize upgrading Suricata instances to patched versions
• Monitor for unusual CPU usage on Suricata hosts
• Implement network filtering to limit malformed SSH traffic if possible