Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMBMAXTX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17.

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root.

This issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A PCRE rule can be written that leads to an infinite loop when negated PCRE is used. Packet processing thread becomes stuck in infinite loop limiting visibility and availability in inline mode. This vulnerability is fixed in 7.0.9.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The bytes setting in the decodebase64 keyword is not properly limited. Due to this, signatures using the keyword and setting can cause large memory allocations of up to 4 GiB per thread. This vulnerability is fixed in 7.0.9.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option to specify the hashsize to use. This size setting isn't properly limited, so the hash table allocation can be large. Untrusted rules can lead to large memory allocations, potentially leading to denial of service due to resource starvation. This vulnerability is fixed in 7.0.9.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AFPACKET defrag option is enabled by default and allows AFPACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.

Here is the fourth Landlock newsletter!

Official website: https://landlock.io Previews newsletter: https://lore.kernel.org/landlock/d4ed5733-d07b-5548-2534-a63e22906778 () digikod net

Articles and conferences ------------------------

We wrote a detailed article about Landlock explaining the underlying concepts, the implementation, and the community: https://landlock.io/talks/2024-06-06landlock-article.pdf This was written for the SSTIC conference: https://www.sstic.org/2024/presentation/landlock-design/

I did a workshop at the Pass the Salt conference to explain how to mitigate security vulnerabilities with Landlock (demonstrated with ImageMagick): https://cfp.pass-the-salt.org/pts2024/talk/8FVYDF/ Related materials are freely available to do it at home: https://github.com/landlock-lsm/workshop-imagemagick

Arto Niemi published a "Survey of Real-World Process Sandboxing" at the Conference of Open Innovations Association (FRUCT): https://fruct.org/publications/volume-35/fruct35/files/Niem.pdf Their conclusion: "[...] we found Landlock and minijail [which uses Landlock] to be relatively convenient from a developer perspective. In general, process self-containment and process-wrapping seems to be an order of magnitude easier to configure than MAC policies."

Researchers from University of Bergamo gave a talk at ASIA CCS conference about Cage4Deno: A Fine-Grained Sandbox for Deno Subprocesses (leveraging Landlock) https://cs.unibg.it/seclab-papers/2023/ASIACCS/paper/cage4deno.pdf They also gave a talk at the RAID conference about NatiSand: Native Code Sandboxing for JavaScript Runtimes (leveraging Landlock) https://cs.unibg.it/seclab-papers/2023/RAID/natisand.pdf

Eric Leblond gave a talk (in French) at the SSTIC conference about sandboxing with Landlock to mitigate real world security issues: https://www.sstic.org/2023/presentation/attaquesupplychainsuricata/

Günther Noack will give a talk at LSS Europe about Landlock and the new IOCTL support: https://sched.co/1ebVW

I'll give a talk at OSS Europe to better explain sandboxing with Landlock: https://sched.co/1ej3a

The XZ backdoor ---------------

XZ Utils is a widely used compression tool and library. The main maintainer implemented sandboxing with Landlock, and released a new version 5.6.0 with this feature. In March 2024, a backdoor was found and reported. It was introduced in February by a new maintainer who earned this trust after more than two years of effort.

Among the malicious changes, the attacker disabled Landlock's support for XZ Utils and released a new version 5.6.1: https://research.swtch.com/xz-timeline The sabotaged configuration check has since been fixed with version 5.6.2, but this effort to stealthily disable sandboxing is a clear sign that Landlock disturbs attackers: https://github.com/tukaani-project/xz/commit/f9cf4c05edd1

Merged kernel features ----------------------

Linux 6.7 (Landlock ABI 4) supports initial network access control with the LANDLOCKACCESSNETBINDTCP and LANDLOCKACCESSNETCONNECTTCP rights thanks to Konstantin Meskhidze. We can now control inbound and outbound TCP connections according to the source or the destination port. This led to kernel code refactoring which opens the way to more network protocol support. See user space documentation: https://docs.kernel.org/userspace-api/landlock.html#network-flags

Linux 6.10 (Landlock ABI 5) supports IOCTL control with the new LANDLOCKACCESSFSIOCTLDEV right thanks to Günther Noack. This restriction only applies to IOCTL commands implemented by device drivers (i.e. block or character devices). As other file system access rights, this can be used to only allow such IOCTL commands on a specified set of file hierarchies per sandbox. See user space documentation: https://docs.kernel.org/userspace-api/landlock.html#filesystem-flags

We also added a slight change in all supported kernels to inform system administrators (with kernel logs) how they can configure the system to support Landlock, if a process tried to sandbox itself on a kernel where Landlock is disabled. New documentation will help enable Landlock on systems when it is not already the case: https://docs.kernel.org/userspace-api/landlock.html#kernel-support

Since Linux 6.3, we improved documentation and kselftests (user space testing), and added support for KUnit (kernel testing). Part of this work lead us to support the UML architecture to easily run application tests in a CI against different kernel versions. With this support we can make sure that backward compatibility works fine for the tested applications. I encourage to take a look at landlock-test-tools and the GitHub CI configuration for the Rust library: https://github.com/landlock-lsm/landlock-test-tools https://github.com/landlock-lsm/rust-landlock/blob/main/.github/workflows/rust.yml#L166-L179

Roadmap and ongoing development -------------------------------

We created GitHub issues to track ongoing and future work: https://github.com/landlock-lsm/linux/issues https://github.com/orgs/landlock-lsm/projects/1

Feel free to reach out if you want to contribute! https://github.com/landlock-lsm/linux/contribute

We also plan to improve the website with extended documentation and examples.

Kernel development highlights -----------------------------

Günther Noack is now an official reviewer of Landlock! https://git.kernel.org/torvalds/c/5bf9e57e634b After the IOCTL feature, he is now working on improving the documentation, including man pages.

Mikhail Ivanov is working on socket type control. This is an important feature that will make it possible to create sandboxes without any network access, except for an explicit list of allowed protocols. This will nicely complement the TCP port control (and future ones for other protocols): https://github.com/landlock-lsm/linux/issues/6 He is also working on controlling TCP listen calls: https://github.com/landlock-lsm/linux/issues/15

Tahera Fahimi was selected as an Outreachy intern to work on IPC restrictions (e.g. abstract unix socket, signals) to better isolate a Landlock domain: https://github.com/landlock-lsm/linux/issues/7 https://github.com/landlock-lsm/linux/issues/8

I'm working on bringing audit support to Landlock: https://github.com/landlock-lsm/linux/issues/3

Landlock libraries ------------------

As explained by Günther Noack, the Go library now supports TCP and IOCTL restrictions: https://blog.gnoack.org/post/landlock-v4/ https://blog.gnoack.org/post/landlock-ioctl/

A new version of the Rust crate was released, with support for TCP control and some miscellaneous improvements: https://github.com/landlock-lsm/rust-landlock/releases/tag/v0.4.0

Please update your dependencies and use the latest Landlock ABI version for improved sandboxing.

We are also working on a new minimal C library: https://github.com/landlock-lsm/linux/issues/38

New Landlock user space supports --------------------------------

Firejail 0.9.74 (sandboxer) will be able to use landlock: https://github.com/netblue30/firejail/pull/6078

setpriv 2.40 (sandboxer): https://github.com/util-linux/util-linux/pull/2628

extrasafe 0.4.0 (sandbox library): https://github.com/boustrophedon/extrasafe/pull/28

bevymodlockdown (sandbox library): https://github.com/FrTerstappen/bevymodlockdown

Cloud Hypervisor (VM monitor) will be sandboxed with Landlock: https://github.com/cloud-hypervisor/cloud-hypervisor/pull/6214

Ukuleleweb (wiki server): https://github.com/gnoack/ukuleleweb/commit/0ecdd54b36fa

websrv 3.2.0 (web server): https://github.com/ngergs/websrv/commit/40fa2d7d2bbb

egress-eddie 0.5.0 (network filtering): https://github.com/capnspacehook/egress-eddie/releases/tag/v0.5.0

Suricata 7.0.0 (network security monitoring engine): https://docs.suricata.io/en/latest/configuration/landlock.html

sslh 2.1.0 (protocol multiplexer): https://lore.kernel.org/landlock/Zfq6f30spnYCx9Y () rutschle net/ https://github.com/yrutschle/sslh/releases/tag/v2.1.0

wireproxy 1.0.8 (Wireguard client): https://github.com/pufferffish/wireproxy/pull/108

Emilua 0.5.0 (Lua runtime): https://lore.kernel.org/landlock/CAK9RveLxro4zUG4jfFB=UNgcv5gdc8JuzNhMt=YbNhH=35ADzg () mail gmail com/ https://docs.emilua.org/api/0.5/changelog.html

Polkadot (blockchain SDK): https://github.com/paritytech/polkadot/pull/7303

XZ Utils 5.6.2 (archive manager): https://github.com/tukaani-project/xz/commit/374868d81d47

Zathura (document viewer) will be sandboxed with Landlock: https://github.com/pwmt/zathura/pull/575

Pacman 7.0.0 (Arch Linux's package manager): https://gitlab.archlinux.org/pacman/pacman/-/mergerequests/167

Thanks to all contributors!

Regards, Mickaël

Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter to suricata/suricatalogsbrowser.php.

An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server. After the TCP SYN packet, it is possible to inject a RST ACK and a FIN ACK packet with a bad TCP Timestamp option. The client will ignore the RST ACK and the FIN ACK packets because of the bad TCP Timestamp option. Both linux and windows client are ignoring the injected packets.

An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by Suricata because it overlaps the FIN packet (the sequence and ack number are identical in the two packets). The client will ignore the fake FIN packet because the ACK flag is not set. Both linux and windows clients are ignoring the injected packet.

In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the httpheader signature to not alert on a response with a single \r\n ending.

An issue was discovered in Suricata 4.1.4. By sending multiple fragmented IPv4 packets, the function Defrag4Reassemble in defrag.c tries to access a memory region that is not allocated, because of a lack of headerlen checking.

An issue was discovered in Suricata 4.1.4. By sending multiple IPv4 packets that have invalid IPv4Options, the function IPV4OptValidateTimestamp in decode-ipv4.c tries to access a memory region that is not allocated. There is a check for o->len < 5 (corresponding to 2 bytes of header and 3 bytes of data). Then, "flag = (o->data + 3)" places one beyond the 3 bytes, because the code should have been "flag = (o->data + 1)" instead.

An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. Upon receiving a corrupted SSLv3 (TLS 1.2) packet, the parser function TLSDecodeHSHelloExtensions tries to access a memory region that is not allocated, because the expected length of HSHelloExtensions does not match the real length of the HSHelloExtensions part of the packet.

An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type, such that the function DecodeEthernet in decode-ethernet.c is executed a second time. At this point, the algorithm cuts the first part of the packet and doesn't determine the current length. Specifically, if the packet is exactly 28 long, in the first iteration it subtracts 14 bytes. Then, it is working with a packet length of 14. At this point, the case distinction says it is a valid packet. After that it casts the packet, but this packet has no type, and the program crashes at the type case distinction.

An issue was discovered in Suricata 4.1.3. The function ftppasvresponse lacks a check for the length of part1 and part2, leading to a crash within the ftp/mod.rs file.

An issue was discovered in Suricata 4.1.3. The function processreplyrecordv3 lacks a check for the length of reply.data. It causes an invalid memory access and the program crashes within the nfs/nfs3.rs file.

An issue was discovered in Suricata 4.1.3. If the network packet does not have the right length, the parser tries to access a part of a DHCP packet. At this point, the Rust environment runs into a panic in parseclientidoption in the dhcp/parser.rs file.

An issue was discovered in Suricata 4.1.3. If the function filetrackernewchunk encounters an unsafe "Some(sfcm) => { ft.newchunk }" item, then the program enters an smb/files.rs error condition and crashes.

Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed sequence of network packets. The component is: detect.c (https://github.com/OISF/suricata/pull/3625/commits/d8634daf74c882356659addb65fb142b738a186b). The attack vector is: An attacker can trigger the vulnerability by a specifically crafted network TCP session. The fixed version is: 4.1.3.

Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed network packet. The component is: app-layer-detect-proto.c, decode.c, decode-teredo.c and decode-ipv6.c (https://github.com/OISF/suricata/pull/3590/commits/11f3659f64a4e42e90cb3c09fcef66894205aefe, https://github.com/OISF/suricata/pull/3590/commits/8357ef3f8ffc7d99ef6571350724160de356158b). The attack vector is: An attacker can trigger the vulnerability by sending a specifically crafted network request. The fixed version is: 4.1.2.

An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow.

A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control flow, such that the condition to leave the loop is true. After leaving the loop, the network packet has a length of 2 bytes. There is no validation of this length. Later on, the code tries to read at an empty position, leading to a crash.

Suricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU. A malformed PDU can cause the parsing code to read beyond the allocated data because DecodeENIPPDU in app-layer-enip-commmon.c has an integer overflow during a length check.

Suricata version 4.0.4 incorrectly handles the parsing of the SSH banner. A malformed SSH banner can cause the parsing code to read beyond the allocated data because SSHParseBanner in app-layer-ssh.c lacks a length check.

The ProcessMimeEntity function in util-decode-mime.c in Suricata 4.x before 4.0.6 allows remote attackers to cause a denial of service (segfault and daemon crash) via crafted input to the SMTP parser, as exploited in the wild in November 2018.

An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the toclient direction, it confuses the rule grouping lookup logic. The toclient inspection will then continue with the wrong rule group. This can lead to missed detection.

Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. This allows detection bypass because Windows TCP clients proceed with normal processing of TCP data that arrives shortly after an RST (i.e., they act as if the RST had not yet been received).

OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99 and sources.py:131. The "list-sources"-command is affected by this bug. that can result in Remote Code Execution(even as root if suricata-update is called by root). This attack appears to be exploitable via a specially crafted yaml-file at https://www.openinfosecfoundation.org/rules/index.yaml. This vulnerability appears to have been fixed in 1.0.0b1.

The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates.