CVE-2025-29915

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/OISF/suricata/commit/d78f2c9a4e2b59f44daeddff098915084493d08d	Patch
https://github.com/OISF/suricata/security/advisories/GHSA-7m5c-cqx4-x8mp	Vendor Advisory Issue Tracking
https://redmine.openinfosecfoundation.org/issues/5373	Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-04-10 20:15

Updated : 2025-05-29 15:47

NVD link : CVE-2025-29915

Mitre link : CVE-2025-29915

CVE.ORG link : CVE-2025-29915

JSON object : View

Products Affected

oisf

suricata

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2025-29915", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-04-10T20:15:23.330", "references": [{"url": "https://github.com/OISF/suricata/commit/d78f2c9a4e2b59f44daeddff098915084493d08d", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/OISF/suricata/security/advisories/GHSA-7m5c-cqx4-x8mp", "tags": ["Vendor Advisory", "Issue Tracking"], "source": "[email protected]"}, {"url": "https://redmine.openinfosecfoundation.org/issues/5373", "tags": ["Issue Tracking"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues."}, {"lang": "es", "value": " Suricata es un sistema de detecci\u00f3n de intrusiones de red, un sistema de prevenci\u00f3n de intrusiones y un motor de monitoreo de seguridad de red. La opci\u00f3n de desfragmentaci\u00f3n AF_PACKET est\u00e1 habilitada de forma predeterminada y permite que AF_PACKET vuelva a ensamblar los paquetes fragmentados antes de llegar a Suricata. Sin embargo, el tama\u00f1o de paquete predeterminado en Suricata se basa en la MTU de la interfaz de red, lo que provoca que Suricata vea paquetes truncados. Actualice a Suricata 7.0.9, que utiliza mejores valores predeterminados y agrega advertencias para las configuraciones de usuario que pueden generar problemas."}], "lastModified": "2025-05-29T15:47:22.367", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9747C005-47BE-4477-9599-5B4177C3579E", "versionEndExcluding": "7.0.9"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}