CVE-2024-55629

What it actually does

Suricata processes TCP streams containing urgent (out-of-band) data differently from the endpoint applications, allowing rule evasion in detection and prevention modes.

Why it matters to the business

Attackers may bypass network inspection controls, raising the chance that malicious traffic reaches internal systems undetected and increasing overall breach exposure in environments that rely on this engine.

How an attack unfolds

An attacker crafts TCP segments with the URG flag set so that Suricata interprets the stream differently than the destination host; the mismatch lets attack traffic avoid matching signatures or anomaly checks until the fix is applied.

How to fix it

Upgrade to Suricata 7.0.8 or apply commit 97e69ffb1bc2b7358115ee59f460a924893664e8. Configure the new urgent-data handling options and, in IPS mode, deploy rules such as drop tcp any any -> any any (sid:1; tcp.flags:U*;) to drop packets with the urgent flag when appropriate.

How to confirm the fix worked

Confirm the installed version is 7.0.8 or later, review the urgent-data configuration, and test with sample traffic containing the URG flag to verify expected handling and rule enforcement.

Typical attack path

1. Identify a network path monitored by an unpatched Suricata instance
2. Send TCP packets carrying the URG flag with a payload crafted to evade rules
3. Rely on the engine's divergent stream processing to bypass detection or blocking
4. Deliver follow-on malicious activity that would otherwise have been inspected

How to detect it

Search Suricata and network logs for TCP segments with the URG flag set; review any alerts or rule hits referencing tcp.flags:U*; examine configuration files for pre-7.0.8 urgent-data settings.

• tcp.flags:U*
• sid:1; tcp.flags:U*

What your security team should do

• Upgrade all Suricata deployments to 7.0.8 or the referenced commit without delay
• Enable and tune the new urgent-data configuration options to match endpoint behavior
• Add or enable IPS rules that drop URG-flagged packets if urgent data is not required in the environment
• Update detection content and run regression tests against evasion test cases