Bug 2257815 (CVE-2023-49295)
| Summary: | CVE-2023-49295 quic-go: memory exhaustion attack against QUIC's path validation mechanism | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | TEJ RATHI <trathi> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alcohan, dymurray, epacific, gparvin, haoli, hkataria, jajackso, jcammara, jhardy, jmatthew, jmitchel, jneedle, jobarker, jwendell, kegrant, koliveir, kshier, lbainbri, mabashia, njean, owatkins, pahickey, pbraun, rcernich, rhaigner, rjohnson, sdawley, shvarugh, simaishi, smcdonal, stcannon, teagle, tfister, thavo, twalsh, whayutin, yguenane, zsadeh |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | quic-go 0.40.1, quic-go 0.39.4, quic-go 0.38.2, quic-go 0.37.7 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A memory exhaustion vulnerability was found in Quic-GO, where a malicious client exploits the path validation mechanism to induce the server into accumulating an unbounded queue of PATH_RESPONSE frames, depleting its memory. The attacker controls the victim's packet send rate by overwhelming the server with numerous packets containing PATH_CHALLENGE frames. Through selective acknowledgments of received packets and manipulation of peer's Round-Trip Time (RTT) estimates, the attacker induces congestion control mechanisms to reduce the server's send rate significantly. Consequently, the victim server is compelled to store an increasing number of queued PATH_RESPONSE frames, resulting in memory exhaustion.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2257827, 2257826, 2257828, 2257829, 2257830, 2257831, 2257832, 2257833 | ||
| Bug Blocks: | 2257834 | ||
|
Description
TEJ RATHI
2024-01-11 07:06:03 UTC
Created caddy tracking bugs for this issue: Affects: epel-8 [bug 2257827] Affects: fedora-all [bug 2257829] Created dnscrypt-proxy tracking bugs for this issue: Affects: fedora-39 [bug 2257830] Created golang-github-lucas-clemente-quic tracking bugs for this issue: Affects: fedora-38 [bug 2257826] Created golang-github-quic tracking bugs for this issue: Affects: fedora-39 [bug 2257831] Created receptor tracking bugs for this issue: Affects: fedora-all [bug 2257832] Created syncthing tracking bugs for this issue: Affects: epel-8 [bug 2257828] Affects: fedora-all [bug 2257833] This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.4 for RHEL 9 Red Hat Ansible Automation Platform 2.4 for RHEL 8 Via RHSA-2024:0855 https://access.redhat.com/errata/RHSA-2024:0855 |