CVE-2024-47187

Executive Summary

CVE-2024-47187 is a medium-severity vulnerability in Suricata, a widely used Network Intrusion Detection System (NIDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine. The flaw resides in the thash (threaded hash table) component, where the random seed for hash table initialization is missing. This omission leads to predictable hash table behavior, making the system susceptible to algorithmic complexity attacks. An attacker can craft specific network traffic or provide malicious dataset files that cause excessive CPU consumption, leading to denial of service (DoS). The vulnerability affects all Suricata versions prior to 7.0.7. While the CVSS score is 7.5 (High), the EPSS score is 0.0%, indicating low exploitation likelihood in the wild at this time. The primary risk is to organizations relying on Suricata for network security monitoring, as an attacker could degrade or disable the sensor.

Supply Chain & Package Security

Suricata is typically deployed as a system package or compiled from source. The vulnerability does not directly affect package registries like NPM or PyPI, but it impacts the integrity of the Suricata software supply chain. Organizations should verify the integrity of their Suricata binaries and ensure they are sourced from trusted repositories. The patch (version 7.0.7) is available from the official Suricata GitHub repository and package maintainers.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector (AV): Network – The vulnerability can be triggered remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The impact is confined to the vulnerable component.
• Confidentiality (C): None – No data exposure.
• Integrity (I): None – No data modification.
• Availability (A): High – The vulnerability can cause a denial of service.

Threat Level: Moderate. While the CVSS score is high, the EPSS score of 0.0% suggests that exploitation is not currently widespread. However, the attack surface is significant as Suricata is often deployed at network perimeters.

Deep Dive & Mechanics

The vulnerability is rooted in the thash (threaded hash table) implementation within Suricata. Hash tables rely on a random seed to distribute entries uniformly and prevent collisions. In versions prior to 7.0.7, the random seed for thash is not initialized, resulting in a deterministic or predictable hash function.

Attack Vector 1: Dataset File Loading Suricata supports loading datasets (e.g., IP blacklists, domain lists) from files. An attacker who can supply a malicious dataset file can craft entries that all hash to the same bucket. This causes the hash table to degrade to a linked list, making insertion and lookup operations O(n) instead of O(1). Loading such a file can consume excessive CPU time, potentially causing the Suricata process to hang or crash.

Attack Vector 2: Network Traffic Handling Suricata uses hash tables to track traffic flows, sessions, and other state. An attacker can send specially crafted network packets that cause hash collisions in these tables. This leads to performance degradation during traffic handling, potentially causing packet drops, latency spikes, or complete sensor failure.

The root cause is a missing call to srandom() or equivalent seed initialization in the thash module. Without this, the hash function produces the same output for the same input across different runs and instances, making it trivial to generate colliding inputs.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7.0.7): In the thash initialization function, the random seed is not set. The hash function relies on an uninitialized or default seed.

// thash.c (vulnerable)
void thash_init(THash *h) {
    // Missing: srandom(time(NULL));
    h->seed = 0; // or uninitialized
}

Patched Code (7.0.7): The patch adds a call to initialize the random seed, ensuring that the hash function produces non-deterministic behavior.

// thash.c (patched)
#include <stdlib.h>
#include <time.h>

void thash_init(THash *h) {
    srandom(time(NULL));
    h->seed = random();
}

The fix ensures that each hash table instance uses a different seed, making it computationally infeasible for an attacker to predict collisions.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running Suricata < 7.0.7 with dataset loading enabled or traffic tracking rules.
• Ability to send network traffic to the target or upload a dataset file.

Exploitation via Dataset File:

1. Generate a dataset file containing entries that all hash to the same bucket. This requires knowledge of the hash function (which is deterministic in vulnerable versions).
2. Upload the file to the Suricata sensor (e.g., via SCP, HTTP, or a management interface).
3. Trigger a reload of the dataset (e.g., via suricatasc or a rule reload).
4. Observe CPU spike and potential service crash.

Exploitation via Network Traffic:

1. Craft packets with specific fields (e.g., IP addresses, ports) that cause hash collisions in the flow tracking table.
2. Send a high volume of such packets to the target.
3. Monitor for performance degradation or denial of service.

Example Python script to generate colliding packets:

import socket
import struct

def craft_colliding_packet(src_ip, dst_ip, src_port, dst_port):
    # Pseudo-code: craft a TCP SYN packet with specific values
    ip_header = struct.pack('!BBHHHBBH4s4s', ...)
    tcp_header = struct.pack('!HHLLBBHHH', src_port, dst_port, ...)
    packet = ip_header + tcp_header
    return packet

# Send multiple packets
sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
for _ in range(10000):
    packet = craft_colliding_packet('10.0.0.1', '10.0.0.2', 12345, 80)
    sock.sendto(packet, ('target_ip', 0))

Blue Team (Defense & Detection)

Detection:

• Monitor Suricata CPU usage for unexplained spikes.
• Alert on Suricata process crashes or restarts.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to Suricata 7.0.7 or later.
• If upgrade is not possible, avoid loading datasets from untrusted sources.
• Restrict network access to the Suricata management interface.
• Implement rate limiting on the sensor to reduce impact of traffic-based attacks.

Indicators of Compromise (IOCs)

• File-based IOCs:

  • Dataset files with an unusually high number of entries that hash to the same bucket (e.g., all entries starting with the same prefix).
  • Suricata log entries indicating excessive hash collisions or slow dataset loading.

• Network-based IOCs:

  • High volume of packets with specific patterns that cause hash collisions (e.g., same source/destination IP and port combinations).
  • Unusual CPU spikes on the Suricata sensor.

• System IOCs:

  • Suricata process consuming 100% CPU for extended periods.
  • Suricata crash dumps or core files.
  • Log entries: ERROR: thash: hash table bucket overflow or similar.

Detection Engineering

YARA Rule

rule CVE_2024_47187_Suricata_Hash_Collision {
    meta:
        description = "Detects Suricata dataset files crafted to exploit CVE-2024-47187"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47187"
    strings:
        $hash_collision = /[a-f0-9]{32}/  // Placeholder for colliding hash entries
    condition:
        // Detect files with many identical hash prefixes
        #hash_collision > 1000 and filesize < 1MB
}

Sigma Rule

title: Suricata Hash Collision DoS Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2024-47187 via excessive hash collisions
author: Valters IT
date: 2025-04-10
logsource:
    product: suricata
    service: suricata
detection:
    selection:
        EventID: 'engine.error'
        Message|contains: 'hash table bucket overflow'
    condition: selection
falsepositives:
    - Legitimate large datasets
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-47187 Potential Hash Collision Attack"; flow:to_server; content:"|00 01 02 03|"; threshold: type both, track by_src, count 1000, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Suricata to version 7.0.7 or later. This is the only complete fix.
2. Workaround: If patching is not possible, avoid loading datasets from untrusted sources. Disable dataset rules that track traffic.
3. Access Control: Restrict network access to the Suricata management interface to trusted hosts only.

Long-term Measures:

• Implement a vulnerability management program to ensure timely patching of critical infrastructure components.
• Monitor Suricata performance metrics (CPU, memory, packet drop rate) for anomalies.
• Use the provided detection rules in your SIEM or IDS.
• Conduct regular security assessments of network security tools.

Valters IT – Securing your digital frontier.