CVE-2019-10056: An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type, such that the function Decode...

Description

An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type, such that the function DecodeEthernet in decode-ethernet.c is executed a second time. At this point, the algorithm cuts the first part of the packet and doesn't determine the current length. Specifically, if the packet is exactly 28 long, in the first iteration it subtracts 14 bytes. Then, it is working with a packet length of 14. At this point, the case distinction says it is a valid packet. After that it casts the packet, but this packet has no type, and the program crashes at the type case distinction.

Metrics

EPSS Probability

1.40%

69.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-787

Affected Software

Vendor	Product	Versions
Suricata-Ids	Suricata	4.1.3
Suricata-Ids	Suricata	4.1.4

References

https://redmine.openinfosecfoundation.org/issues/2946Exploit, Issue Tracking, Third Party Advisory
https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/Not Applicable, Release Notes, Vendor Advisory
https://redmine.openinfosecfoundation.org/issues/2946Exploit, Issue Tracking, Third Party Advisory
https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/Not Applicable, Release Notes, Vendor Advisory

Timeline

Published: Aug 28, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-10056?

An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type, such that the function DecodeEthernet in decode-ethernet.c is executed a second time. At this point, the algorithm cuts the first part of the packet and doesn't determine the current length. Specifically, if the packet is exactly 28 long, in the first iteration it subtracts 14 bytes. Then, it is working with a packet length of 14. At this point, the case distinction says it is a valid packet. After that it casts the packet, but this packet has no type, and the program crashes at the type case distinction.

How severe is CVE-2019-10056?

Severity scoring for CVE-2019-10056 is pending analysis. The EPSS model estimates a 1.40% probability of exploitation in the next 30 days.

How do I fix CVE-2019-10056?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2019

View all 2019CVEs →