Microsoft Windows up to Server 2019 HTTP/2 HTTP.sys resource consumption

Summaryinfo

A vulnerability marked as critical has been reported in Microsoft Windows up to Server 2019. Impacted is an unknown function in the library HTTP.sys of the component HTTP2 Handler. This manipulation causes resource consumption. The identification of this vulnerability is CVE-2019-9512. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability classified as critical was found in Microsoft Windows up to Server 2019 (Operating System). Affected by this vulnerability is an unknown code in the library HTTP.sys of the component HTTP2 Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability.

The weakness was shared 08/13/2019 as confirmed security update guide (Website). The advisory is shared at portal.msrc.microsoft.com. The vendor cooperated in the coordination of the public release. This vulnerability is known as CVE-2019-9512 since 03/01/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue. The advisory points out:

A denial of service vulnerability exists in the HTTP/2 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP/2 requests. An attacker who successfully exploited the vulnerability could create a denial of service condition, causing the target system to become unresponsive.

The vulnerability scanner Nessus provides a plugin with the ID 236585 (Alibaba Cloud Linux 3 : 0069: go-toolset:rhel8 (ALINUX3-SA-2021:0069)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Tenable (236585) and CERT Bund (WID-SEC-2022-0770). The entries VDB-139968, VDB-139970, VDB-139971 and VDB-139972 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• IBM DB2
• Red Hat Enterprise Linux
• IBM SPSS
• EMC Avamar
• Hitachi Ops Center

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 10
• 10 1607
• 10 1703
• 10 1709
• 10 1803
• 10 1809
• 10 1903
• Server 1803
• Server 1903
• Server 2016
• Server 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion