Google Go HTTP/2 Reset resource consumption

Summaryinfo

A vulnerability described as problematic has been identified in Google Go. Affected is an unknown function of the component HTTP2 Reset Handler. Such manipulation leads to resource consumption. This vulnerability is listed as CVE-2023-39325. The attack may be performed from remote. In addition, an exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Google Go (Programming Language Software) (unknown version) and classified as problematic. Affected by this issue is an unknown code block of the component HTTP2 Reset Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

The weakness was presented 10/12/2023. This vulnerability is handled as CVE-2023-39325 since 07/27/2023. Technical details are unknown but an exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

It is declared as highly functional. The vulnerability scanner Nessus provides a plugin with the ID 208702 (Ubuntu 22.04 LTS : Go vulnerabilities (USN-7061-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (208702) and CERT Bund (WID-SEC-2024-1228). Once again VulDB remains the best source for vulnerability data.

Affected

• Red Hat Enterprise Linux
• Red Hat OpenStack
• IBM MQ
• Red Hat OpenShift

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion