GHSA-xhg9-xwch-vr7x

Source
https://github.com/advisories/GHSA-xhg9-xwch-vr7x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-xhg9-xwch-vr7x/GHSA-xhg9-xwch-vr7x.json
Aliases
  • CVE-2024-1410
Published
2024-03-13T15:38:21Z
Modified
2024-03-13T16:11:39.536316Z
Details

Impact

Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers (IDs); see RFC 9000 Section 5.1. Endpoints declare the number of active connection IDs they are willing to support using the activeconnectionidlimit transport parameter. The peer can create new IDs using a NEWCONNECTIONID frame but must stay within the active ID limit. This is done by retirement of old IDs, the endpoint sends NEWCONNECTIONID includes a value in the retirepriorto field, which elicits a RETIRECONNECTIONID frame as confirmation. An unauthenticated remote attacker can exploit the vulnerability by sending NEWCONNECTIONID frames and manipulating the connection (e.g. by restricting the peer's congestion window size) so that RETIRECONNECTION_ID frames can only be sent at a slower rate than they are received, leading to storage of information related to connection IDs in an unbounded queue.

Patches

Quiche versions 0.19.2 and 0.20.1 are the earliest to address this problem. There is no workaround for affected versions.

References

Affected packages

crates.io / quiche

Package

Name
quiche

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
0.19.2

crates.io / quiche

Package

Name
quiche

Affected ranges

Type
SEMVER
Events
Introduced
0.20.0
Fixed
0.20.1