CVE-2011-1465 in Chrome
Summary
by MITRE
The SPDY implementation in net/http/http_network_transaction.cc in Google Chrome before 11.0.696.14 drains the bodies from SPDY responses, which might allow remote SPDY servers to cause a denial of service (application exit) by canceling a stream.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/20/2017
The vulnerability identified as CVE-2011-1465 resides within the SPDY protocol implementation in Google Chrome's net/http/http_network_transaction.cc file. This flaw specifically affects Chrome versions prior to 11.0.696.14 and represents a critical denial of service vulnerability that could be exploited by remote attackers. The issue manifests when the browser processes SPDY responses, where the implementation fails to properly handle stream cancellation events, leading to application instability and potential crashes.
The technical flaw occurs during the processing of SPDY protocol streams where Chrome's HTTP network transaction handler attempts to drain response bodies from SPDY responses. When a remote SPDY server cancels a stream during the response processing phase, the browser's implementation does not properly account for this cancellation event. This improper handling causes the application to enter an unstable state where it may terminate unexpectedly or become unresponsive. The vulnerability stems from inadequate error handling and stream management within the SPDY protocol stack, creating a condition where legitimate stream cancellation operations trigger application-level failures rather than graceful degradation.
From an operational impact perspective, this vulnerability presents a significant threat to web browsing security and availability. Remote attackers can exploit this weakness by setting up malicious SPDY servers that deliberately cancel streams during response transmission, causing Chrome to crash and exit unexpectedly. This type of denial of service attack could be particularly damaging in environments where Chrome is the primary browser, as users would experience frequent application crashes and forced restarts. The impact extends beyond individual user experience to potentially affect enterprise environments where browser stability is critical for business operations, and could be leveraged in larger-scale attacks targeting browser availability.
The vulnerability aligns with CWE-400, which covers "Uncontrolled Resource Consumption," and demonstrates characteristics consistent with the ATT&CK technique T1499.004 for "Endpoint Denial of Service." Organizations should implement immediate mitigation strategies including updating to Chrome version 11.0.696.14 or later, which contains the necessary patches to properly handle SPDY stream cancellations. Network administrators should also consider implementing SPDY protocol filtering or blocking mechanisms at the network level to prevent exploitation until full patch deployment is achieved. Additionally, monitoring for unusual stream cancellation patterns and application crash reports can help identify potential exploitation attempts. The fix implemented in the patched version addresses the core issue by ensuring proper stream state management and error handling during SPDY response processing, preventing the application from crashing when encountering stream cancellation events from remote servers.