CVE-2025-29916

Executive Summary

CVE-2025-29916 is a denial-of-service (DoS) vulnerability in Suricata, a widely used network intrusion detection and prevention system (IDS/IPS). The flaw resides in how Suricata handles the hashsize option for datasets declared in rules. An attacker who can supply or influence a malicious rule can set an arbitrarily large hashsize, causing Suricata to allocate an excessive amount of memory for the hash table. This can lead to resource starvation and a denial-of-service condition. The vulnerability is fixed in Suricata version 7.0.9. The CVSS score is 6.2 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood in the wild at this time.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Suricata software itself, which is often distributed via package managers or compiled from source. Users should verify the integrity of their Suricata installation and ensure they are using a trusted source.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Base Score: 6.2 (Medium)
• Attack Vector (AV): Local (L) – The attacker must have local access to the system or be able to influence rule loading.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No privileges needed to trigger the vulnerability.
• User Interaction (UI): Required (R) – The victim must load a malicious rule.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability due to resource exhaustion.

Threat Level: Medium. The vulnerability requires user interaction (loading a malicious rule) and local access, but the impact on availability is severe.

Deep Dive & Mechanics

Suricata allows rules to declare datasets (e.g., for IP reputation or string matching) with an optional hashsize parameter. This parameter determines the initial size of the hash table used to store the dataset. The vulnerability arises because the hashsize value is not validated or limited. An attacker can craft a rule with an extremely large hashsize (e.g., 2^31 or higher), causing Suricata to attempt to allocate a hash table of that size. This can exhaust available memory, leading to a denial-of-service condition.

The vulnerable code path is in the dataset initialization routine, where hashsize is used directly in a memory allocation call (e.g., malloc or calloc). Without a cap, the allocation can be enormous, causing the process to crash or the system to become unresponsive.

Vulnerable vs. Patched Code

Vulnerable Code (Suricata < 7.0.9):

// Example of vulnerable dataset initialization
void dataset_init(Dataset *ds, uint32_t hashsize) {
    ds->hash_table = calloc(hashsize, sizeof(HashEntry));
    // No validation of hashsize
}

Patched Code (Suricata 7.0.9):

// Patched version with limit
#define MAX_HASHSIZE 1048576 // 1 million entries

void dataset_init(Dataset *ds, uint32_t hashsize) {
    if (hashsize > MAX_HASHSIZE) {
        hashsize = MAX_HASHSIZE;
    }
    ds->hash_table = calloc(hashsize, sizeof(HashEntry));
}

The patch introduces a maximum limit for hashsize, preventing excessive memory allocation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Suricata instance (version < 7.0.9).
• Ability to load custom rules (e.g., via suricata -S malicious.rules).

Exploit Steps:

1. Create a malicious rule file (e.g., malicious.rules) with a dataset declaration using an extremely large hashsize:

   alert tcp any any -> any any (msg:"DoS via hashsize"; content:"|00|"; dataset:type ip, name malicious, hashsize 4294967295; sid:1000001; rev:1;)
   

2. Load the rule into Suricata:

   suricata -S malicious.rules -i eth0
   

3. Suricata will attempt to allocate a hash table of size 4294967295, consuming all available memory and causing a denial of service.

Expected Outcome: Suricata process crashes or system becomes unresponsive due to memory exhaustion.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual memory allocation patterns in Suricata processes.
• Use the detection rules provided in the Detection Engineering section.

Defense:

• Upgrade to Suricata 7.0.9 or later.
• Implement rule validation to reject rules with excessively large hashsize values.
• Use resource limits (e.g., ulimit or cgroups) to restrict memory usage of Suricata.

Indicators of Compromise (IOCs)

• File Hashes (Malicious Rule):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Process Behavior:
  • Suricata process consuming excessive memory (e.g., > 10 GB).
  • System logs showing out-of-memory (OOM) killer terminating Suricata.
• Network Traffic:
  • No specific network IOCs; the attack is triggered by rule loading.

Detection Engineering

YARA Rule

rule CVE_2025_29916_Suricata_Hashsize_DoS {
    meta:
        description = "Detects malicious Suricata rules with excessive hashsize"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29916"
    strings:
        $hashsize = /hashsize\s+\d{7,}/ nocase
    condition:
        $hashsize
}

Sigma Rule

title: Suricata Malicious Rule with Large Hashsize
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects loading of Suricata rules with excessively large hashsize parameter
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-29916
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/suricata'
        CommandLine|contains: 'hashsize'
    condition: selection
falsepositives:
    - Legitimate use of large datasets (unlikely)
level: high

Suricata Rule (Detection)

alert tcp any any -> any any (msg:"CVE-2025-29916 - Potential DoS via hashsize"; content:"hashsize"; distance:0; within:100; pcre:"/hashsize\s+\d{7,}/i"; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Suricata to version 7.0.9 or later.
2. Validate Rules before loading: Reject any rule with hashsize > 1,000,000.
3. Restrict Rule Sources to trusted entities only.

Long-Term Measures:

• Implement resource limits (e.g., ulimit -v or cgroups) to cap memory usage.
• Monitor Suricata logs for unusual memory allocation errors.
• Regularly update Suricata to the latest stable version.

Workarounds:

• If upgrade is not possible, manually patch the source code to add a hashsize limit (as shown in the patched code section) and recompile.

Valters IT
Securing Digital Frontiers