Suricata

Two issues identified:

1. threads: flow manager reads thread store during startup without lock

In offline mode, the flow manager checks whether time is ready by walking the thread store without the store lock. Startup can still reallocate the store at that point, so with 27–30 autofp workers it reads freed memory (ASAN heap-use-after-free in TmThreadsTimeSubsysIsReady()). Introduced by 276d625a6; 8.0.x is affected too. Fixed in 3329893a7.

2. unix-manager: commands served before threads are unpaused

The unix socket thread answers commands while the other threads are still being set up. With unix-command enabled in offline mode, list-hostbit and add-hostbit walk the thread store during a reallocation and read
freed memory (ASAN heap-use-after-free in TmThreadsGetMinimalTimestamp()). Fixed in 3fcf5d4b9, which makes the socket wait until the engine has started.

I have some on-going work needing further verification.