CVE-2025-59150
📋 TL;DR
A NULL pointer dereference vulnerability in Suricata's TLS subject alternative name parsing causes segmentation faults when processing malicious TLS certificates containing NULL bytes in subjectaltname fields. This affects all systems running Suricata 8.0.0 for network monitoring, potentially causing denial of service. The vulnerability is triggered when Suricata processes TLS traffic with specially crafted certificates.
💻 Affected Systems
- Suricata
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete Suricata service crash leading to loss of network monitoring, intrusion detection, and prevention capabilities, potentially allowing undetected attacks to pass through.
Likely Case
Suricata process crashes when encountering malicious TLS certificates, causing temporary loss of monitoring until service restart.
If Mitigated
With proper segmentation and redundant monitoring, impact is limited to single sensor failure with minimal network disruption.
🎯 Exploit Status
Exploitation requires sending specially crafted TLS certificates to trigger the NULL pointer dereference. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.1
Vendor Advisory: https://github.com/OISF/suricata/security/advisories/GHSA-mhv7-qfmj-m3f3
Restart Required: Yes
Instructions:
1. Download Suricata 8.0.1 from official sources. 2. Stop Suricata service. 3. Install new version following platform-specific instructions. 4. Restart Suricata service. 5. Verify version and functionality.
🔧 Temporary Workarounds
Disable tls.subjectaltname rules
allRemove or disable all rules using the tls.subjectaltname keyword to prevent triggering the vulnerability
suricata -T --disable-rules tls.subjectaltname
Edit rules files to comment out or remove rules with tls.subjectaltname keyword
🧯 If You Can't Patch
- Implement network segmentation to limit TLS traffic to Suricata sensors
- Deploy redundant Suricata instances with automatic failover to maintain monitoring during crashes
🔍 How to Verify
Check if Vulnerable:
Check Suricata version: suricata -V | grep 'version' and verify if it's 8.0.0. Also check if any active rules use tls.subjectaltname keyword.Check Version:
suricata -V | grep 'version'Verify Fix Applied:
Verify version is 8.0.1 or higher: suricata -V | grep 'version'. Test with sample TLS traffic containing subjectaltname fields.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in Suricata logs
- Process crashes with core dumps
- Unexpected Suricata service restarts
Network Indicators:
- Unusual TLS certificates with NULL bytes in subjectaltname fields
- Multiple connection attempts with malformed TLS handshakes
SIEM Query:
source="suricata.log" AND ("segmentation fault" OR "core dumped" OR "SIGSEGV")🔗 References
- https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018
- https://github.com/OISF/suricata/commit/d590fdfe42e995fd558315f0c24f9a352e21479d
- https://github.com/OISF/suricata/security/advisories/GHSA-mhv7-qfmj-m3f3
- https://redmine.openinfosecfoundation.org/issues/7881
- https://www.vicarius.io/vsociety/posts/cve-2025-59150-suricata-detection-script
- https://www.vicarius.io/vsociety/posts/cve-2025-59150-suricata-mitigation-script
