Security #7195: datasets: rule with unset makes suricata abort - Suricata - Open Information Security Foundation

Actions

Security #7195

closed

PA PA

datasets: rule with unset makes suricata abort

Security #7195: datasets: rule with unset makes suricata abort

Added by Philippe Antoine over 1 year ago. Updated over 1 year ago.

Status:

Closed

Priority:

Normal

Assignee:

Philippe Antoine

Target version:

Affected Versions:

Label:

CVE:

Git IDs:

e47598110a557bb9f87ea498d85ba91a45bb0cb6

Severity:

HIGH

Disclosure Date:

Description

Running SV datasets-03-set test with added rule

diff --git a/tests/datasets-03-set/test.rules b/tests/datasets-03-set/test.rules
index 1d99df9d..327c774a 100644
--- a/tests/datasets-03-set/test.rules
+++ b/tests/datasets-03-set/test.rules
@@ -1 +1,2 @@
 alert dns any any -> any any (dns.query; dataset:set,dns-seen, type string; sid:1;)
+alert dns any any -> any any (dns.query; content: "example"; dataset:unset,dns-seen, type string; sid:2;)

triggers the abort in DetectDatasetBufferMatch because we get DETECT_DATASET_CMD_UNSET

Subtasks 1 (0 open — 1 closed)

Related issues 1 (1 open — 0 closed)

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
#1

Related to Feature #5576: Dataset is setting data despite the signature being a complete match added

OT Updated by OISF Ticketbot over 1 year ago Actions
Copy link
#2

Subtask #7196 added

OT Updated by OISF Ticketbot over 1 year ago Actions
Copy link
#3

Label deleted (~~Needs backport to 7.0~~)

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
#4

Status changed from New to In Review

Gitlab MR

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
#5

unset support in datasets was half-done.

A fix can be implementing the missing support

Another fix can be to reject such rules for now

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
#6

Severity changed from MODERATE to HIGH

HIGH as it requires a bad rule, but then it aborts in defined way.

JF Updated by Juliana Fajardini Reichow over 1 year ago Actions
Copy link
#7

CVE set to 2024-45795

https://github.com/OISF/suricata/security/advisories/GHSA-6r8w-fpw6-cp9g

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
#8

Status changed from In Review to Resolved

https://github.com/OISF/suricata/pull/11815

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
#9

Still SV test to merge before closing https://github.com/OISF/suricata-verify/pull/2065

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
#10

Git IDs updated (diff)

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
#11

Private changed from Yes to No

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
#12

Status changed from Resolved to Closed

https://github.com/OISF/suricata-verify/pull/2071

Actions

Also available in: PDF Atom