Suricata Heap Use-After-Free Vulnerability in Alert Queue Management

A heap use-after-free vulnerability has been identified in Suricata, a network IDS, IPS, and NSM engine, in versions prior to 8.0.3 and 7.0.14. The issue arises from an unsigned integer overflow during the alert queue expansion process, which can be triggered by generating excessive alerts for a single packet. This overflow leads to a use-after-free condition, allowing for potential memory corruption.

Impact

Exploitation of this vulnerability causes a heap use-after-free condition, which can lead to memory corruption and potentially allow for arbitrary code execution.

Remediation

Users can upgrade to Suricata versions 8.0.3 or 7.0.14, both of which include the necessary patch. Additionally, it is recommended not to run untrusted rulesets and to limit the number of signatures that can match the same packet to fewer than 65,536.