CVE-2024-45795: Oisf Suricata DoS Vulnerability

CVE-2024-45795 Overview

CVE-2024-45795 affects Suricata, an open-source network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine maintained by the Open Information Security Foundation (OISF). Versions prior to 7.0.7 contain a flaw in dataset rule handling. Rules using the non-functional unset option trigger an assertion failure during traffic parsing, halting the engine. The defect is classified under CWE-617: Reachable Assertion. The issue was resolved in Suricata 7.0.7.

Critical Impact
An attacker can crash a Suricata sensor by causing rule evaluation against crafted traffic when a vulnerable ruleset containing unset dataset options is loaded, eliminating network visibility and IPS protection.

Affected Products

OISF Suricata versions prior to 7.0.7
Deployments using rulesets that reference dataset rules with the unset option
Network sensors operating in IDS or IPS mode that load affected rules

Discovery Timeline

2024-10-16 - CVE-2024-45795 published to NVD
2024-10-22 - Last updated in NVD database

Technical Details for CVE-2024-45795

Vulnerability Analysis

The vulnerability resides in Suricata's dataset feature, which supports list-based matching across rules. Suricata's rule language exposes an unset option for datasets that was never implemented in the engine. When the rule parser or traffic processor encounters this option during evaluation, it reaches an internal assertion that the developers expected to be unreachable. The assertion aborts the Suricata process, terminating packet inspection. With an EPSS score of 0.728% (73rd percentile), the vulnerability has moderate predicted exploitation likelihood.

Root Cause

The root cause is a reachable assertion [CWE-617] tied to an unimplemented rule keyword. Suricata accepts and parses the unset dataset option but lacks supporting logic. Instead of rejecting the unknown option cleanly, the engine progresses to a code path guarded by an assertion that fails at runtime. The fix in version 7.0.7 prevents the assertion from being reached when this option appears.

Attack Vector

Exploitation requires that a Suricata deployment load a ruleset containing the unset dataset option. Once such a rule is active, traffic matching the rule's pre-conditions triggers the assertion and crashes the engine. The attack vector is network-based and requires no authentication or user interaction. The primary risk arises from untrusted or poorly tested third-party rulesets being deployed in production sensors. See the GitHub Security Advisory GHSA-6r8w-fpw6-cp9g for technical details.

Detection Methods for CVE-2024-45795

Indicators of Compromise

Unexpected termination of the suricata process accompanied by an assertion failure message in stderr or system logs
Gaps in EVE JSON output, flow logs, or alert pipelines that correspond to sensor crashes
Presence of dataset rules containing the unset option within loaded .rules files

Detection Strategies

Audit all active rulesets with grep -r "dataset:.*unset" /etc/suricata/rules/ to identify rules using the unimplemented option
Monitor Suricata service health via systemd unit status, watchdog timers, or process supervision tooling
Correlate sensor downtime with traffic capture timestamps to identify potential trigger events

Monitoring Recommendations

Forward Suricata stderr and suricata.log to a centralized log platform and alert on assertion failure strings
Track Suricata process uptime and restart counts as health metrics in your monitoring system
Validate ruleset changes in a staging environment before pushing to production sensors

How to Mitigate CVE-2024-45795

Immediate Actions Required

Upgrade Suricata to version 7.0.7 or later on all sensors
Inventory loaded rulesets and remove any rules containing the unset dataset option until the upgrade is complete
Restrict rule sources to trusted, well-maintained feeds such as Emerging Threats or vendor-supplied rule packages

Patch Information

OISF released the fix in Suricata 7.0.7. Refer to the GitHub Security Advisory GHSA-6r8w-fpw6-cp9g and the OISF Redmine issue 7195 for upstream patch details and release notes.

Workarounds

Use only trusted and well-tested rulesets, as recommended by the OISF advisory
Remove or comment out any rule that contains the unset dataset option from custom rule files
Implement automatic restart for the Suricata service to reduce downtime if the assertion is triggered

bash

# Identify rules using the vulnerable unset dataset option
grep -rnE 'dataset:[^;]*unset' /etc/suricata/rules/

# Verify running Suricata version
suricata --build-info | head -n 2

# Example systemd override to auto-restart on crash
# /etc/systemd/system/suricata.service.d/restart.conf
[Service]
Restart=on-failure
RestartSec=5s