CVE-2024-47187

What it actually does

Uninitialized random seed for the thash structure produces deterministic hash table ordering, enabling crafted datasets to trigger pathological O(n) or worse lookup/insert chains that inflate both load time and per-packet processing cost.

Why it matters to the business

Network monitoring and detection capabilities can be slowed or temporarily disabled when untrusted dataset files are loaded, increasing exposure to undetected threats and consuming excess CPU or memory on sensors.

How an attack unfolds

An attacker supplies a specially ordered dataset file to a Suricata instance that has not yet initialized its thash seed; the predictable hash function causes excessive collisions, resulting in long load times and sustained high CPU usage while processing live traffic that matches dataset rules.

How to fix it

Upgrade to Suricata 7.0.7 or apply commit 572a16fb5a28a582c6e219d946485d9778b64014. As a temporary control, do not load datasets from untrusted sources and avoid rules that rely on dataset tracking.

How to confirm the fix worked

Confirm the running binary reports version 7.0.7 or later; after upgrade, time the load of both benign and previously pathological datasets and verify that load duration and per-packet CPU remain within expected bounds.

Typical attack path

1. Identify a Suricata deployment that accepts external dataset files or rules referencing datasets
2. Craft or obtain a dataset whose keys produce worst-case hash collisions under the fixed seed
3. Cause the sensor to load the dataset (via rule reload, restart, or file drop)
4. Observe or trigger traffic that exercises the affected dataset rules to amplify runtime cost

How to detect it

Review Suricata startup and reload logs for unusually long dataset load durations; correlate with high CPU or memory usage on the sensor process during traffic handling; inspect any external dataset files introduced around the time of performance degradation.

What your security team should do

• Immediately upgrade all Suricata instances to 7.0.7
• Audit and restrict which dataset files may be loaded by sensors
• Disable or rewrite rules that use dataset tracking until patches are deployed
• Monitor sensor reload times and CPU usage for sudden spikes after dataset changes