CVE-2024-22189 QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

2024-04-0414:25:43

CWE-770

GitHub_M

www.cve.org

quic-go

quic protocol

memory exhaustion

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

15.5%

JSON

quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRE_CONNECTION_ID frame. The attacker can prevent the receiver from sending out (the vast majority of) these RETIRE_CONNECTION_ID frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer’s RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.

CNA Affected

[
  {
    "vendor": "quic-go",
    "product": "quic-go",
    "versions": [
      {
        "version": "< 0.42.0",
        "status": "affected"
      }
    ]
  }
]