Security #6900: http2: timeout logging headers - Suricata - Open Information Security Foundation

Custom queries

8.0.0 Stories
Good First Issues
OISF community
Open Doc tasks

Actions

Copy link

Security #6900

closed

PA PA

http2: timeout logging headers

Security #6900: http2: timeout logging headers

Added by Philippe Antoine about 2 years ago. Updated almost 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Philippe Antoine

Target version:

8.0.0-beta1

Affected Versions:

Label:

CVE:

2024-32663

Git IDs:

03442c9071b8d863d26b609d54c6eacf4de9e340

Severity:

HIGH

Disclosure Date:

06/28/2024

Description

Found by oss-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67661

Investigating more in this issue

Subtasks 2 (0 open — 2 closed)

	Security #6901: http2: timeout logging headers (7.0.x backport)	Closed	Philippe Antoine	Actions
	Security #6978: http2: timeout logging headers (6.0.x backport)	Closed	Philippe Antoine	Actions

Related issues 5 (0 open — 5 closed)

Related to Suricata - Bug #6846: eve/alerts: wrongly using tx id 0 when there is no tx	Closed	Philippe Antoine	Actions
Related to Suricata - Security #6892: http2: oom on copying compressed headers	Closed	Philippe Antoine	Actions
Related to Suricata - Security #6770: log: arbitrary-length value can be logged	Closed	OISF Dev	Actions
Related to Suricata - Bug #6973: detect: log relevant frames app-layer metdata	Closed	Philippe Antoine	Actions
Related to Suricata - Security #7104: http2: oom from duplicate headers	Closed	Philippe Antoine	Actions

Issue # Delay: days Cancel Multiple values allowed (comma separated).

History
Notes
Property changes

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
#1

Related to Bug #6846: eve/alerts: wrongly using tx id 0 when there is no tx added

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
#2

Fix for #6846 fixes this timeout because we get multiple alerts for sid 2210045 and 2210029 which logs http2 app-layer data when it should not

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
#3

Related to Security #6892: http2: oom on copying compressed headers added

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
#4

http2 logging does not take too much time because a single field is too long, but we log 35367 headers.

This get bad because of http2 headers compression where one byte in the network can refer up to HTTP2_MAX_TABLESIZE (65536 by default, configurable with app-layer.protocols.http2.max-table-size bytes previously seen on the network.