quic-go up to 0.27.0 Request mtu_discoverer.go denial of service ⚔ [Disputed]

Summaryinfo

A vulnerability, which was classified as problematic, has been found in quic-go up to 0.27.0. This impacts the function mtu_discoverer.go of the component Request Handler. The manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2022-30591. The attack is possible to be carried out remotely. No exploit exists. The actual existence of this vulnerability is currently in question.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in quic-go up to 0.27.0. This issue affects the function mtu_discoverer.go of the component Request Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. The summary by CVE is:

** DISPUTED ** quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequently overflows the probe timer. NOTE: the vendor's position is that this behavior should not be listed as a vulnerability on the CVE List.

The weakness was disclosed 07/06/2022. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2022-30591 since 05/11/2022. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• quic-go

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion