CVE-2025-29915

Executive Summary

CVE-2025-29915 is a high-severity vulnerability (CVSS 7.5) in Suricata, a widely used network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine. The flaw resides in the AF_PACKET defragmentation option, which is enabled by default. This option allows the AF_PACKET socket to reassemble fragmented IP packets before they reach Suricata for inspection. However, Suricata's default packet buffer size is based on the network interface's Maximum Transmission Unit (MTU). When fragmented packets are reassembled, the resulting packet can exceed the MTU, causing Suricata to see only truncated packets. This leads to missed detections and potential evasion of network security monitoring. The vulnerability is unpatched in versions prior to 7.0.9, which introduces better defaults and configuration warnings.

Supply Chain & Package Security

Suricata is distributed as a standalone application, not as an NPM, PyPI, Go, or Ruby package. Therefore, supply chain package security concerns are not directly applicable. However, organizations should verify the integrity of Suricata binaries or source code from the official repository (https://github.com/OISF/suricata) and ensure they are not using compromised or unofficial builds.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely by sending fragmented packets over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; an attacker can simply send fragmented IP packets.
• Privileges Required (PR): None (N) – No authentication or privileges are needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No direct data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – The vulnerability can cause Suricata to miss detection of malicious traffic, effectively degrading its availability as a security monitoring tool.

Threat Level: High. The vulnerability allows an attacker to evade detection by sending fragmented packets that are reassembled into oversized packets, which Suricata truncates. This can lead to undetected malicious activity, including data exfiltration, command-and-control communication, or exploitation attempts.

Deep Dive & Mechanics

The AF_PACKET socket is a Linux-specific feature that allows direct access to network packets at the data link layer. Suricata uses AF_PACKET in "defrag" mode to reassemble fragmented IP packets before inspection. This is intended to ensure that Suricata sees the complete payload of fragmented packets, which is crucial for accurate detection.

The Vulnerability:

1. Default Configuration: The af-packet section in Suricata's configuration (suricata.yaml) has a defrag option that defaults to yes. This enables IP defragmentation at the AF_PACKET level.
2. Buffer Size Mismatch: Suricata's default packet buffer size is derived from the network interface's MTU (e.g., 1500 bytes for Ethernet). When AF_PACKET reassembles fragmented packets, the resulting packet can be larger than the MTU (e.g., a 3000-byte payload split into two 1500-byte fragments).
3. Truncation: Suricata allocates a buffer based on the MTU to receive packets from AF_PACKET. If the reassembled packet exceeds this buffer size, the packet is truncated. Suricata only inspects the truncated portion, missing the rest of the payload.

Attack Scenario: An attacker can craft fragmented IP packets that, when reassembled, form a malicious payload (e.g., an exploit or command) that is larger than the MTU. Suricata will only see the first part of the payload, potentially missing the malicious content. For example, an attacker could split a SQL injection payload across two fragments. Suricata would only inspect the first fragment, which might appear benign, while the second fragment contains the injection.

Root Cause: The default buffer size is not adjusted for defragmented packets. The fix in Suricata 7.0.9 changes the default buffer size to a larger value (e.g., 65535 bytes) when defrag is enabled, and adds warnings for configurations that may lead to truncation.

Vulnerable vs. Patched Code

Vulnerable Configuration (suricata.yaml):

af-packet:
  - interface: eth0
    defrag: yes
    # No explicit buffer-size set; defaults to MTU (e.g., 1500)

Patched Configuration (Suricata 7.0.9):

af-packet:
  - interface: eth0
    defrag: yes
    buffer-size: 65535  # Explicitly set to handle defragmented packets

Code Change (Conceptual): In the source code, the vulnerable version uses iface->mtu as the default buffer size. The patched version checks if defrag is enabled and, if so, uses a larger default (e.g., 65535) or warns the user to set an appropriate buffer-size.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Objective: Evade Suricata detection by sending fragmented packets that are reassembled into oversized payloads.

Lab Setup:

• Attacker: Kali Linux with scapy or hping3
• Target: Suricata 7.0.8 (or earlier) running on Ubuntu 22.04 with AF_PACKET defrag enabled
• Network: Both machines on the same subnet

Exploit Steps:

1. Craft Fragmented Packets: Use scapy to send a malicious payload (e.g., a simple "alert" string) split across two IP fragments.
2. Send to Target: The target Suricata will reassemble the fragments, but the resulting packet will exceed the MTU (e.g., 1500 bytes). Suricata will truncate the packet and only inspect the first fragment.
3. Verify Evasion: Check Suricata logs; the malicious payload should not trigger any alert.

Example Scapy Script:

from scapy.all import *

# Malicious payload (e.g., 2000 bytes)
payload = "A" * 2000

# Fragment the payload
fragments = fragment(IP(dst="192.168.1.100")/UDP(sport=1234, dport=80)/Raw(load=payload), fragsize=1400)

# Send fragments
for frag in fragments:
    send(frag)

Expected Result: Suricata does not alert on the payload because it only sees the first 1500 bytes (truncated).

Blue Team (Defense & Detection)

Detection:

• Monitor for fragmented packets that are larger than the MTU after reassembly.
• Use network taps or port mirroring to capture full packets before Suricata truncation.

Mitigation:

• Upgrade to Suricata 7.0.9 or later.
• If upgrade is not possible, manually set buffer-size to a large value (e.g., 65535) in the af-packet configuration.
• Enable Suricata's built-in IP defragmentation (separate from AF_PACKET) to handle oversized packets.

Hunting Query (Suricata):

# Check for truncated packets in Suricata stats
suricata --dump-stats | grep -i trunc

Indicators of Compromise (IOCs)

• Network Traffic:
  • IP fragments with total reassembled size > interface MTU (e.g., > 1500 bytes)
  • Fragmented packets where the first fragment contains benign data and subsequent fragments contain malicious payloads
• Suricata Logs:
  • Log entries indicating packet truncation (e.g., "packet truncated" or "pcap: truncated packet")
  • Missing alerts for known malicious patterns that were sent as fragmented packets
• System Logs:
  • Suricata error messages related to buffer size or defragmentation

Detection Engineering

YARA Rule

rule CVE_2025_29915_Suricata_Defrag_Evasion {
    meta:
        description = "Detects fragmented IP packets that may evade Suricata due to AF_PACKET defrag truncation"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-29915"
    strings:
        $frag_offset = { 45 00 }  // IP header with fragment offset (first byte 0x45, second byte 0x00)
        $more_fragments = { 20 }   // More fragments flag (bit 1 of IP flags)
    condition:
        $frag_offset at 0 and $more_fragments at 1
}

Sigma Rule

title: Suricata AF_PACKET Defrag Evasion Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects fragmented IP packets that may be used to evade Suricata detection due to AF_PACKET defrag truncation (CVE-2025-29915)
author: Valters IT
date: 2025/04/10
logsource:
    category: network_flow
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 2100000  # Example signature ID for fragmentation
    condition: selection
falsepositives:
    - Legitimate fragmented traffic (e.g., NFS, VoIP)
level: medium
tags:
    - attack.t1190
    - cve.2025.29915

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-29915 - Possible AF_PACKET Defrag Evasion"; fragbits: M; ip_proto: != tcp; sid: 1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Suricata: Update to version 7.0.9 or later, which includes better defaults and warnings.
2. Manual Configuration: If upgrade is not possible, edit suricata.yaml and set buffer-size: 65535 under the af-packet section for each interface.
3. Enable Suricata IP Defrag: Use Suricata's built-in IP defragmentation engine (separate from AF_PACKET) by setting defrag: yes in the ip-defrag configuration.

Long-Term Measures:

• Regularly update Suricata to the latest stable version.
• Monitor Suricata logs for truncation warnings.
• Implement network segmentation to limit exposure of IDS/IPS systems.
• Use additional network monitoring tools (e.g., Zeek) to cross-check Suricata alerts.

Workaround:

• Disable AF_PACKET defrag (defrag: no) and rely on Suricata's own IP defragmentation. Note: This may impact performance on high-speed networks.

Valters IT