CVE-2025-29915
📋 TL;DR
Suricata's default AF_PACKET defrag configuration causes packet truncation when reassembling fragmented packets, leading to incomplete network traffic analysis. This affects all Suricata deployments using default settings, potentially allowing malicious traffic to evade detection.
💻 Affected Systems
- Suricata
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass Suricata's intrusion detection/prevention entirely by fragmenting malicious packets, enabling undetected network attacks, data exfiltration, or lateral movement.
Likely Case
Suricata fails to detect or prevent attacks that use packet fragmentation, reducing security monitoring effectiveness and allowing some malicious traffic through.
If Mitigated
With proper configuration or patching, Suricata correctly handles fragmented packets, maintaining full network security monitoring capabilities.
🎯 Exploit Status
Exploitation requires sending fragmented packets to the monitored network, which is trivial for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.9
Vendor Advisory: https://github.com/OISF/suricata/security/advisories/GHSA-7m5c-cqx4-x8mp
Restart Required: Yes
Instructions:
1. Download Suricata 7.0.9 from official sources. 2. Stop Suricata service. 3. Install/upgrade to 7.0.9. 4. Restart Suricata service. 5. Verify new version is running.
🔧 Temporary Workarounds
Disable AF_PACKET defrag
linuxDisable packet defragmentation in AF_PACKET configuration to prevent truncation issues
Edit suricata.yaml: set 'af-packet:
- defrag: false'
Increase packet buffer size
linuxManually configure larger packet buffer size to accommodate reassembled packets
Edit suricata.yaml: set 'max-pending-packets: 10000' and adjust 'af-packet:
- buffer-size' appropriately
🧯 If You Can't Patch
- Disable AF_PACKET defragmentation in configuration
- Use alternative capture methods like PF_RING or NFQUEUE instead of AF_PACKET
🔍 How to Verify
Check if Vulnerable:
Check Suricata version and configuration: 'suricata --build-info' and verify if using AF_PACKET with default settingsCheck Version:
suricata --build-info | grep VersionVerify Fix Applied:
Confirm version is 7.0.9 or later: 'suricata --build-info | grep Version' and test with fragmented packet capture📡 Detection & Monitoring
Log Indicators:
- Suricata logs showing packet truncation warnings
- Missing expected alerts for known attack patterns
Network Indicators:
- Unusual increase in fragmented packets
- Traffic patterns that should trigger alerts but don't
SIEM Query:
source="suricata" ("truncated" OR "fragment" OR "defrag") AND severity>=WARNING