| id: GO-2024-2682 |
| modules: |
| - module: github.com/quic-go/quic-go |
| versions: |
| - fixed: 0.42.0 |
| vulnerable_at: 0.41.0 |
| packages: |
| - package: github.com/quic-go/quic-go |
| symbols: |
| - framerI.QueueControlFrame |
| - connection.run |
| derived_symbols: |
| - Dial |
| - DialAddr |
| - DialAddrEarly |
| - DialEarly |
| - Listen |
| - ListenAddr |
| - ListenAddrEarly |
| - ListenEarly |
| - Transport.Dial |
| - Transport.DialEarly |
| - Transport.Listen |
| - Transport.ListenEarly |
| - connIDGenerator.Retire |
| - connIDGenerator.SetMaxActiveConnIDs |
| - connIDManager.Add |
| - connIDManager.Get |
| - connection.AcceptStream |
| - connection.AcceptUniStream |
| - connection.OpenStream |
| - connection.OpenStreamSync |
| - connection.OpenUniStream |
| - connection.OpenUniStreamSync |
| - framerI.AppendStreamFrames |
| - packetPacker.AppendPacket |
| - packetPacker.MaybePackProbePacket |
| - packetPacker.PackAckOnlyPacket |
| - packetPacker.PackApplicationClose |
| - packetPacker.PackCoalescedPacket |
| - packetPacker.PackConnectionClose |
| - packetPacker.PackMTUProbePacket |
| - receiveStream.CancelRead |
| - receiveStream.CloseRemote |
| - receiveStream.Read |
| - sendStream.CancelWrite |
| - streamsMap.AcceptStream |
| - streamsMap.AcceptUniStream |
| - streamsMap.DeleteStream |
| - streamsMap.HandleMaxStreamsFrame |
| - streamsMap.OpenStream |
| - streamsMap.OpenStreamSync |
| - streamsMap.OpenUniStream |
| - streamsMap.OpenUniStreamSync |
| - streamsMap.UpdateLimits |
| - windowUpdateQueue.QueueAll |
| summary: Denial of service via connection starvation in github.com/quic-go/quic-go |
| description: |- |
| An attacker can cause its peer to run out of memory by sending a large number of |
| NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is |
| supposed to respond to each retirement frame with a RETIRE_CONNECTION_ID frame. |
| The attacker can prevent the receiver from sending out (the vast majority of) |
| these RETIRE_CONNECTION_ID frames by collapsing the peers congestion window (by |
| selectively acknowledging received packets) and by manipulating the peer's RTT |
| estimate. |
| cves: |
| - CVE-2024-22189 |
| ghsas: |
| - GHSA-c33x-xqrf-c478 |
| credits: |
| - marten-seemann |
| references: |
| - fix: https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c85ed47a |
| - web: https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-management |
| review_status: REVIEWED |
