Project

General

Profile

Actions
Copy link

Bug #2288

closed

Suricata segfaults on ICMP and flowint check

Added by Edward Fjellskål about 7 years ago. Updated about 7 years ago.

Status:
Closed
Priority:
High
Assignee:
Victor Julien
Target version:
4.1beta1
Affected Versions:
Effort:
Difficulty:
Label:

Description

Using only this rule on Suricata v3.2.3, v4.0.0 and v4.0.1 :

alert icmp any any -> any any (msg:"Dump Core!"; flowint:segfault,isset; classtype:trojan-activity; sid:31337; rev:1337;)

Parsing a pcap with icmp traffic makes suricata segfault:

suricata: line 10: 28912 Segmentation fault (core dumped) $BIN $OPTS -c $CONF -r $1

Compiled:
$ ./configure --prefix=/somepath/ --enable-profiling --enable-lua

Running:
$ ./path/to/suricata -c suricata.yaml -r icmp.pcap

Actions
Copy link

Also available in: Atom PDF