CVE-2024-45796

What it actually does

A logic error in the fragment reassembly code prevents valid fragmented network traffic from being correctly reassembled, resulting in dropped or mishandled packets within the IDS/IPS engine.

Why it matters to the business

Network security monitoring may miss detections for legitimate traffic patterns, reducing visibility into potential threats and increasing operational risk for organizations relying on Suricata for intrusion detection.

How an attack unfolds

An attacker crafts fragmented packets that exploit the reassembly logic error, causing the engine to fail processing valid traffic and potentially allowing malicious activity to evade detection.

How to fix it

Upgrade to Suricata version 7.0.7 or apply the patch from commit 572a16fb5a28a582c6e219d946485d9778b64014 in the oisf/suricata GIT repository.

How to confirm the fix worked

Confirm the installed Suricata version is 7.0.7 or newer; replay valid fragmented traffic through the sensor and verify successful reassembly in logs or alerts.

Typical attack path

1. Identify a network monitored by an affected Suricata instance
2. Craft packets with specific fragmentation that triggers the logic error
3. Transmit the packets across the monitored network segment
4. Observe or confirm reassembly failure and any resulting detection gaps

How to detect it

Examine Suricata logs for entries related to fragment reassembly failures or errors; correlate with network flow data showing high volumes of fragmented packets that do not trigger expected alerts.

What your security team should do

• Prioritize upgrade to the fixed version across all Suricata deployments
• Review and tune fragment reassembly settings if immediate upgrade is delayed
• Monitor upstream Suricata release notes for any related follow-on fixes