Vulnerability Report: GO-2024-2682
- CVE-2024-22189, GHSA-c33x-xqrf-c478
- Affects: github.com/quic-go/quic-go
- Published: Apr 05, 2024
An attacker can cause its peer to run out of memory by sending a large number of NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRE_CONNECTION_ID frame. The attacker can prevent the receiver from sending out (the vast majority of) these RETIRE_CONNECTION_ID frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate.
Affected Packages
-
PathVersionsSymbols
-
before v0.42.0
Aliases
References
- https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c85ed47a
- https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-management
- https://vuln.go.dev/ID/GO-2024-2682.json
Credits
- marten-seemann
Feedback
See anything missing or incorrect?
Suggest an edit to this report.