Vulnerability · Published Oct 16, 2024 · Assigned by GitHub_M
CVE-2024-47187Suricata datasets: missing hashtable random seed leads to potential DoS
High 7.5
In plain English
A high-severity weak randomness in suricata from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.7, missing initialization of the random seed for "thash" leads to datasets having predictable hash table behavior. This can lead to dataset file loading to use excessive time to load, as well as runtime performance issues during traffic handling. This issue has been addressed in 7.0.7. As a workaround, avoid loading datasets from untrusted sources. Avoid dataset rules that track traffic in rules.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | suricata | 7.0.7-r0 | ALPINE-CVE-2024-47187 |
| Alpine:v3.21 | suricata | 7.0.7-r0 | ALPINE-CVE-2024-47187 |
| Alpine:v3.22 | suricata | 7.0.7-r0 | ALPINE-CVE-2024-47187 |
| Alpine:v3.23 | suricata | 7.0.7-r0 | ALPINE-CVE-2024-47187 |
| Alpine:v3.24 | suricata | 7.0.7-r0 | ALPINE-CVE-2024-47187 |
| Debian:13 | suricata | 1:7.0.7-1 | DEBIAN-CVE-2024-47187 |
| Debian:14 | suricata | 1:7.0.7-1 | DEBIAN-CVE-2024-47187 |
| Ubuntu:22.04:LTS | suricata | no fix listed | UBUNTU-CVE-2024-47187 |
| Ubuntu:24.04:LTS | suricata | no fix listed | UBUNTU-CVE-2024-47187 |
| Ubuntu:25.10 | suricata | no fix listed | UBUNTU-CVE-2024-47187 |
| Ubuntu:26.04:LTS | suricata | no fix listed | UBUNTU-CVE-2024-47187 |
| Ubuntu:26.10 | suricata | no fix listed | UBUNTU-CVE-2024-47187 |
Affected products (as reported)
Weakness: CWE-330 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/OISF/suricata/security/advisories/GHSA-64ww-4f6x-863p x_refsource_CONFIRM
- https://redmine.openinfosecfoundation.org/issues/7209 x_refsource_MISC