PT-2024-2968 · Quic-Go+1 · Quic-Go+1

Marten-Seemann

·

Published

2024-04-02

·

Updated

2024-09-27

·

CVE-2024-22189

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions quic-go versions prior to 0.42.0
Description The issue is related to the QUIC protocol implementation in quic-go, where an attacker can cause its peer to run out of memory by sending a large number of NEW CONNECTION ID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRE CONNECTION ID frame. However, the attacker can prevent the receiver from sending out these RETIRE CONNECTION ID frames by collapsing the peer's congestion window and manipulating the peer's RTT estimate.
Recommendations For quic-go versions prior to 0.42.0, update to version 0.42.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of NEW CONNECTION ID frames until a patch is available. Avoid using the NEW CONNECTION ID frame in the affected API endpoint until the issue is resolved.

Exploit

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

Related Identifiers

AZL-39749
AZL-39851
BDU:2024-03135
CVE-2024-22189
GHSA-C33X-XQRF-C478
GO-2024-2682
OPENSUSE-SU-2024:0211-1
OPENSUSE-SU-2024:0220-1
OPENSUSE-SU-2024:0319-1
OPENSUSE-SU-2024:13845-1
OPENSUSE-SU-2024:13847-1
OPENSUSE-SU-2024:13849-1
OPENSUSE-SU-2024:13865-1
OPENSUSE-SU-2024:14014-1
RHSA-2024:8534

Affected Products

Debian
Quic-Go