Lucene search

K
osvGoogleOSV:RUSTSEC-2024-0336
HistoryApr 19, 2024 - 12:00 p.m.

`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input

2024-04-1912:00:00
Google
osv.dev
8
rustls
connectioncommon
complete_io
infinite loop
network input
close_notify alert
handshake
rustls-tokio
rustls-ffi
stream
streamowned
affected

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0

Percentile

15.5%

If a close_notify alert is received during a handshake, complete_io
does not terminate.

Callers which do not call complete_io are not affected.

rustls-tokio and rustls-ffi do not call complete_io
and are not affected.

rustls::Stream and rustls::StreamOwned types use
complete_io and are affected.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0

Percentile

15.5%