CVE-2024-23835: Insufficient Information (NVD-CWE-noinfo)
value: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.  Prior to version 7.0.3, excessive memory use during pgsql parsing could lead to OOM-related crashes.  This vulnerability is patched in 7.0.3.  As workaround, users can disable the pgsql app layer parser.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-26T16:27Z
Repository: https://github.com/OISF/suricata
Language: Rust
Files changed: rust/src/pgsql/parser.rs
Commit date: 2024-02-06 15:16:43 +0100
Commit message: pgsql: parse only PDU when type is unknown

A next PDU may already be in the slice to parse.
Do not skip its parsing, ie do not use rest, but take just
the length of the pdu

Diff: diff --git a/rust/src/pgsql/parser.rs b/rust/src/pgsql/parser.rs
index 4dbb2915c2..886ee4c5dc 100644
--- a/rust/src/pgsql/parser.rs
+++ b/rust/src/pgsql/parser.rs
@@ -21,11 +21,11 @@
 
 use crate::common::nom7::take_until_and_consume;
 use nom7::branch::alt;
 use nom7::bytes::streaming::{tag, take, take_until, take_until1};
 use nom7::character::streaming::{alphanumeric1, char};
-use nom7::combinator::{all_consuming, cond, eof, map_parser, opt, peek, rest, verify};
+use nom7::combinator::{all_consuming, cond, eof, map_parser, opt, peek, verify};
 use nom7::error::{make_error, ErrorKind};
 use nom7::multi::{many1, many_m_n, many_till};
 use nom7::number::streaming::{be_i16, be_i32};
 use nom7::number::streaming::{be_u16, be_u32, be_u8};
 use nom7::sequence::{terminated, tuple};
@@ -1076,14 +1076,16 @@ pub fn pgsql_parse_response(i: &[u8]) -> IResult<&[u8], PgsqlBEMessage> {
                 b'Z' => parse_ready_for_query(i)?,
                 b'T' => parse_row_description(i)?,
                 b'A' => parse_notification_response(i)?,
                 b'D' => parse_consolidated_data_row(i)?,
                 _ => {
-                    let (i, payload) = rest(i)?;
+                    let (i, identifier) = be_u8(i)?;
+                    let (i, length) = verify(be_u32, |&x| x > PGSQL_LENGTH_FIELD)(i)?;
+                    let (i, payload) = take(length - PGSQL_LENGTH_FIELD)(i)?;
                     let unknown = PgsqlBEMessage::UnknownMessageType (RegularPacket{
-                        identifier: pseudo_header.0,
-                        length: pseudo_header.1,
+                        identifier,
+                        length,
                         payload: payload.to_vec(),
                     });
                     (i, unknown)
                 }
 
@@ -1916,11 +1918,11 @@ mod tests {
         ];
         let (remainder, result) = pgsql_parse_response(bad_buf).expect("parsing sasl final response failed");
         let res = PgsqlBEMessage::UnknownMessageType(RegularPacket {
             identifier: b'`',
             length: 54,
-            payload: bad_buf.to_vec(),
+            payload: bad_buf[5..].to_vec(),
         });
         assert_eq!(result, res);
         assert!(remainder.is_empty());
     }
 

Vulnerable code: use nom7::combinator::{all_consuming, cond, eof, map_parser, opt, peek, rest, verify};
                    let (i, payload) = rest(i)?;
                        identifier: pseudo_header.0,
                        length: pseudo_header.1,
            payload: bad_buf.to_vec(),
Fixed code: use nom7::combinator::{all_consuming, cond, eof, map_parser, opt, peek, verify};
                    let (i, identifier) = be_u8(i)?;
                    let (i, length) = verify(be_u32, |&x| x > PGSQL_LENGTH_FIELD)(i)?;
                    let (i, payload) = take(length - PGSQL_LENGTH_FIELD)(i)?;
                        identifier,
                        length,
            payload: bad_buf[5..].to_vec(),