Ripple20 Critical Vulnerabilities – Detection Logic and Signatures

This McAfee Advanced Threat Research / JSOF report analyzes multiple critical vulnerabilities in the Treck TCP/IP stack (Ripple20), including CVE-2020-11901 (DNS heap overflows variants), CVE-2020-11897 (IPv6 RH0 out-of-bounds), and CVE-2020-11896 (IPv4/UDP tunneling RCE). It documents technical root causes, limitations and detection challenges, and provides recommended detection criteria plus Suricata rules and Lua scripts to help identify exploitation attempts.