Security #7959: detect/entropy: null deref when used with base64_data - Suricata - Open Information Security Foundation

Actions

Copy link

Security #7959

closed

PA PA

detect/entropy: null deref when used with base64_data

Security #7959: detect/entropy: null deref when used with base64_data

Added by Philippe Antoine about 1 year ago. Updated 3 days ago.

Status:

Closed

Priority:

Normal

Assignee:

Philippe Antoine

Target version:

9.0.0-beta1

Affected Versions:

Label:

CVE:

2025-64335

Git IDs:

6d703af505ddf3c2a98eaff24cb1461dbf1ae1a2

Severity:

HIGH

Disclosure Date:

10/29/2025

GHSA:

Description

Found by oss-fuzz:
https://issues.oss-fuzz.com/u/1/issues/447714701

When used with base64_data suricata will segfault

Rule

dROp ip :: 3 <> :: 1 base64_decode;base64_datA;entropy:value 0;sid:6;

Stack:

==8300==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ff802b94b32 bp 0x7ff7be694d90 sp 0x7ff7be694d90 T0)
==8300==The signal is caused by a READ memory access.
==8300==Hint: address points to the zero page.
    #0 0x7ff802b94b32 in _platform_strlen+0x12 (libsystem_platform.dylib:x86_64+0x1b32)
    #1 0x000103a11392 in strlen+0x32 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x19392)
    #2 0x000101d30806 in VariableNameHash util-var-name.c:339
    #3 0x000101c98ab7 in HashListTableLookup util-hashlist.c:253
    #4 0x000101d31010 in VarNameStoreRegister util-var-name.c:162
    #5 0x000101a66a0a in DetectEntropySetup detect-entropy.c
    #6 0x000101ad6c86 in SigParse detect-parse.c:1896
    #7 0x000101ad18b5 in SigInitHelper detect-parse.c:2907
    #8 0x000101acecc6 in SigInitDo detect-parse.c:3054
    #9 0x000101858679 in LLVMFuzzerTestOneInput fuzz_siginit.c:53

Subtasks 1 (0 open — 1 closed)