CVE-2025-64330
📋 TL;DR
A heap overflow vulnerability in Suricata's logging functionality can cause crashes when specific alert queue conditions are met. This affects Suricata versions before 7.0.13 and 8.0.2 when verdict logging is enabled. Organizations using vulnerable Suricata deployments for network monitoring are affected.
💻 Affected Systems
- Suricata
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Denial of service causing Suricata to crash, potentially disrupting network monitoring and intrusion detection capabilities.
Likely Case
Service disruption and crashes of Suricata processes, leading to gaps in network security monitoring.
If Mitigated
Minimal impact with proper queue size configuration and monitoring in place.
🎯 Exploit Status
Exploitation requires filling the per packet alert queue with alerts followed by a pass rule, which requires specific network conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.13 and 8.0.2
Vendor Advisory: https://github.com/OISF/suricata/security/advisories/GHSA-83v7-gm34-f437
Restart Required: Yes
Instructions:
1. Download Suricata 7.0.13 or 8.0.2 from official sources. 2. Stop Suricata service. 3. Install updated version. 4. Restart Suricata service.
🔧 Temporary Workarounds
Increase alert queue size
allIncrease packet-alert-max value in suricata.yaml to reduce likelihood of exploitation
Edit suricata.yaml and increase 'packet-alert-max' value
Disable verdict logging
allDisable verdict logging in eve.alert and eve.drop records if not required
Set 'eve-log.alert.verdict' and 'eve-log.drop.verdict' to false in suricata.yaml
🧯 If You Can't Patch
- Increase packet-alert-max value significantly in suricata.yaml configuration
- Disable verdict logging in eve.alert and eve.drop records
🔍 How to Verify
Check if Vulnerable:
Check Suricata version and configuration for verdict logging enabled with vulnerable versionsCheck Version:
suricata --build-info | grep VersionVerify Fix Applied:
Verify Suricata version is 7.0.13 or higher (7.x) or 8.0.2 or higher (8.x)📡 Detection & Monitoring
Log Indicators:
- Suricata crash logs
- Segmentation fault errors in system logs
- Unexpected Suricata process termination
Network Indicators:
- Sudden drop in Suricata alert volume
- Missing network monitoring data
SIEM Query:
source="suricata" AND ("segmentation fault" OR "crash" OR "terminated unexpectedly")