GO-2024-2682

An attacker can cause its peer to run out of memory by sending a large number of NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRE_CONNECTION_ID frame. The attacker can prevent the receiver from sending out (the vast majority of) these RETIRE_CONNECTION_ID frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2024-2682"
}

References

Credits

- marten-seemann

Affected packages

Go / github.com/quic-go/quic-go

Package

Name: github.com/quic-go/quic-go; View open source insights on deps.dev
Purl: pkg:golang/github.com/quic-go/quic-go

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.42.0

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/quic-go/quic-go",
            "symbols": [
                "Dial",
                "DialAddr",
                "DialAddrEarly",
                "DialEarly",
                "Listen",
                "ListenAddr",
                "ListenAddrEarly",
                "ListenEarly",
                "Transport.Dial",
                "Transport.DialEarly",
                "Transport.Listen",
                "Transport.ListenEarly",
                "connIDGenerator.Retire",
                "connIDGenerator.SetMaxActiveConnIDs",
                "connIDManager.Add",
                "connIDManager.Get",
                "connection.AcceptStream",
                "connection.AcceptUniStream",
                "connection.OpenStream",
                "connection.OpenStreamSync",
                "connection.OpenUniStream",
                "connection.OpenUniStreamSync",
                "connection.run",
                "framerI.AppendStreamFrames",
                "framerI.QueueControlFrame",
                "packetPacker.AppendPacket",
                "packetPacker.MaybePackProbePacket",
                "packetPacker.PackAckOnlyPacket",
                "packetPacker.PackApplicationClose",
                "packetPacker.PackCoalescedPacket",
                "packetPacker.PackConnectionClose",
                "packetPacker.PackMTUProbePacket",
                "receiveStream.CancelRead",
                "receiveStream.CloseRemote",
                "receiveStream.Read",
                "sendStream.CancelWrite",
                "streamsMap.AcceptStream",
                "streamsMap.AcceptUniStream",
                "streamsMap.DeleteStream",
                "streamsMap.HandleMaxStreamsFrame",
                "streamsMap.OpenStream",
                "streamsMap.OpenStreamSync",
                "streamsMap.OpenUniStream",
                "streamsMap.OpenUniStreamSync",
                "streamsMap.UpdateLimits",
                "windowUpdateQueue.QueueAll"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2024-2682.json"