Project

General

Profile

Actions
Copy link

Bug #3662

closed

Signature with an IP range creates one IPOnlyCIDRItem by IP address

Added by Philippe Antoine over 4 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
6.0.0beta1
Affected Versions:
5.0.2
Effort:
Difficulty:
Label:
Needs backport, Needs backport to 4.1, Needs backport to 5.0

Description

Found by fuzzing https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21817

For example, when we want the range 41.232.107.2-43.252.37.6, it creates millions of IPOnlyCIDRItem because it gives them all a netmask of 32

Solution is to extend the net mask so that it uses 

41.232.107.3/32
41.232.107.4/30
41.232.107.8/29
41.232.107.16/28
41.232.107.32/27
41.232.107.64/26
41.232.107.128/25
41.232.108.0/22
41.232.112.0/20
41.232.128.0/17
41.233.0.0/16
41.234.0.0/15
41.236.0.0/14
41.240.0.0/12
42.0.0.0/8
43.0.0.0/9
43.128.0.0/10
43.192.0.0/11
43.224.0.0/12
43.240.0.0/13
43.248.0.0/14
43.252.0.0/19
43.252.32.0/22
43.252.36.0/24
43.252.37.0/30
43.252.37.4/31
43.252.37.6/32

Related issues 3 (0 open — 3 closed)

Is duplicate of Suricata - Bug #3568: rules: bad rule leads to memory exhaustionClosedJeff LucovskyActions
Copied to Suricata - Bug #3667: Signature with an IP range creates one IPOnlyCIDRItem by IP addressClosedJeff LucovskyActions
Copied to Suricata - Bug #3668: Signature with an IP range creates one IPOnlyCIDRItem by IP addressClosedShivani BhardwajActions
Actions
Copy link

Also available in: Atom PDF