CyberRota Analysis
AI-GeneratedSuricata versions 8.0.0 to 8.0.4 are vulnerable to a flaw where certain detection transforms can lead to reading from a reallocated and freed inspection buffer, potentially causing the system to crash when processing malicious network traffic. This issue necessitates the use of specific detection rules that exploit the vulnerability. Organizations using Suricata for network security monitoring should prioritize upgrading to version 8.0.5 or implementing the recommended workaround to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after it had been reallocated and freed. The issue is reached during network traffic processing, but requires a malicious rule as Suricata will crash whatever the traffic. Version 8.0.5 contains a fix. As a workaround, avoid rules that chain `gunzip` or `zlib_deflate` with `max-size` bigger than 4096 after another transform.