quinn-rs quinn up to 0.11.6 Connection ID retry control flow

Summaryinfo

A vulnerability classified as critical was found in quinn-rs quinn up to 0.11.6. This issue affects the function retry of the component Connection ID Handler. Executing a manipulation can lead to control flow. This vulnerability is handled as CVE-2024-45311. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in quinn-rs quinn up to 0.11.6. This vulnerability affects the function retry of the component Connection ID Handler. The manipulation with an unknown input leads to a control flow vulnerability. The CWE definition for the vulnerability is CWE-670. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. As an impact it is known to affect availability. CVE summarizes:

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to `accept()`, `retry()`, `refuse()`, or `ignore()` an `Incoming` connection. However, calling `retry()` on an unvalidated connection exposes the server to a likely panic in the following situations: 1. Calling `refuse` or `ignore` on the resulting validated connection, if a duplicate initial packet is received. This issue can go undetected until a server's `refuse()`/`ignore()` code path is exercised, such as to stop a denial of service attack. 2. Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received. This issue can go undetected if clients are well-behaved. The former situation was observed in a real application, while the latter is only theoretical.

The advisory is available at github.com. This vulnerability was named CVE-2024-45311 since 08/26/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 0.11.7 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• quinn-rs

Name

• quinn

Version

• 0.11.0
• 0.11.1
• 0.11.2
• 0.11.3
• 0.11.4
• 0.11.5
• 0.11.6

Website

• Product: https://github.com/quinn-rs/quinn/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion