Suricata modbus: txs without responses are never freed
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.9%
exploitation probability
0.9%top 45% of all CVEs
observed exploitation
nono source reports it
In short
Suricata can accumulate unlimited resources when processing specially crafted Modbus network traffic, potentially causing the system to run out of memory or become unresponsive. This happens because incomplete Modbus requests are not properly cleaned up.
Technical detail
Suricata's Modbus parser fails to free transaction structures (txs) when responses are absent, allowing an attacker to send crafted Modbus traffic that triggers unbounded resource accumulation within a flow. The vulnerability is mitigated by limiting stream.reassembly.depth; fixed in version 7.0.6.
Summary generated and translated by AI from the official description.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Crafted modbus traffic can lead to unlimited resource accumulation within a flow. Upgrade to 7.0.6. Set a limited stream.reassembly.depth to reduce the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
OISF · suricata