CVE-2024-45795

What it actually does

Rules using datasets with the unimplemented "unset" option trigger an assertion failure during traffic parsing, resulting in process termination.

Why it matters to the business

The network monitoring engine can crash under normal traffic loads when specific rules are active, interrupting detection and prevention capabilities until restarted.

How an attack unfolds

An attacker sends network traffic that matches a rule containing a dataset with the unset option; the engine hits the assertion during parsing and terminates, causing denial of service. No public exploits or threat actor campaigns are known.

How to fix it

Upgrade to version 7.0.7 or apply commit 572a16fb5a28a582c6e219d946485d9778b64014. As a temporary measure, restrict rulesets to only trusted and well-tested ones that avoid the unset option.

How to confirm the fix worked

Confirm the running version is 7.0.7 or later; test rules containing dataset options in a lab environment to ensure no assertion occurs on traffic replay.

Typical attack path

1. Deploy or load a ruleset containing a dataset rule that uses the non-functional unset option
2. Send traffic that triggers evaluation of the affected rule
3. Engine encounters the assertion during dataset handling and aborts

How to detect it

Review Suricata process logs and system crash reports for assertion failures or abrupt terminations around the time of traffic parsing; correlate with ruleset load events.

What your security team should do

• Upgrade Suricata to 7.0.7 immediately given the public fix availability
• Audit deployed rulesets and remove or rewrite any rules using dataset unset
• Monitor process stability and restart automation until upgrade is complete