Project

General

Profile

Actions
Copy link

Security #6900

closed

http2: timeout logging headers

Added by Philippe Antoine 4 months ago. Updated 3 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
8.0.0-beta1
Affected Versions:
Label:
CVE:
2024-32663
Git IDs:

03442c9071b8d863d26b609d54c6eacf4de9e340

Severity:
HIGH
Disclosure Date:
06/28/2024

Description

Found by oss-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67661

Investigating more in this issue

Subtasks 2 (0 open — 2 closed)

Security #6901: http2: timeout logging headers (7.0.x backport)ClosedPhilippe AntoineActions
Security #6978: http2: timeout logging headers (6.0.x backport)ClosedPhilippe AntoineActions

Related issues 3 (0 open — 3 closed)

Related to Suricata - Bug #6846: alerts: wrongly using tx id 0 when there is no txClosedPhilippe AntoineActions
Related to Suricata - Security #6892: http2: oom on copying compressed headersClosedPhilippe AntoineActions
Related to Suricata - Bug #6973: detect: log relevant frames app-layer metdataClosedPhilippe AntoineActions
Actions
Copy link
 #1

Updated by Philippe Antoine 4 months ago

  • Related to Bug #6846: alerts: wrongly using tx id 0 when there is no tx added
Actions
Copy link
 #2

Updated by Philippe Antoine 4 months ago

Fix for #6846 fixes this timeout because we get multiple alerts for sid 2210045 and 2210029 which logs http2 app-layer data when it should not

Actions
Copy link
 #3

Updated by Philippe Antoine 4 months ago

  • Related to Security #6892: http2: oom on copying compressed headers added
Actions
Copy link
 #4

Updated by Philippe Antoine 4 months ago

http2 logging does not take too much time because a single field is too long, but we log 35367 headers.

This get bad because of http2 headers compression where one byte in the network can refer up to HTTP2_MAX_TABLESIZE (65536 by default, configurable with app-layer.protocols.http2.max-table-size bytes previously seen on the network.

Actions
Copy link
 #5

Updated by Philippe Antoine 4 months ago

I guess this is critical

Actions
Copy link
 #6

Updated by Philippe Antoine 4 months ago

  • Status changed from New to In Review
  • Label Needs backport to 7.0 added
Actions
Copy link
 #7

Updated by OISF Ticketbot 4 months ago

  • Subtask #6901 added
Actions
Copy link
 #8

Updated by OISF Ticketbot 4 months ago

  • Label deleted (Needs backport to 7.0)
Actions
Copy link
 #10

Updated by Victor Julien 3 months ago

  • CVE set to 2024-32663
Actions
Copy link
 #11

Updated by Victor Julien 3 months ago

  • Label Needs backport to 6.0 added
Actions
Copy link
 #12

Updated by OISF Ticketbot 3 months ago

  • Subtask #6978 added
Actions
Copy link
 #13

Updated by OISF Ticketbot 3 months ago

  • Label deleted (Needs backport to 6.0)
Actions
Copy link
 #14

Updated by Victor Julien 3 months ago

  • Severity changed from MODERATE to HIGH
Actions
Copy link
 #15

Updated by Victor Julien 3 months ago

  • Status changed from In Review to Closed
  • Git IDs updated (diff)
Actions
Copy link
 #16

Updated by Philippe Antoine 3 months ago

  • Related to Bug #6973: detect: log relevant frames app-layer metdata added
Actions
Copy link
 #17

Updated by Philippe Antoine 3 months ago ยท Edited

For info, the oss-fuzz report is still open until #6848 gets solved

Actions
Copy link

Also available in: Atom PDF