quic-go up to 0.48.1 IP_PMTUDISC_DO denial of service

Summaryinfo

A vulnerability categorized as problematic has been discovered in quic-go up to 0.48.1. This impacts the function IP_PMTUDISC_DO. Such manipulation leads to denial of service. This vulnerability is listed as CVE-2024-53259. The attack must be carried out from within the local network. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in quic-go up to 0.48.1. It has been rated as critical. Affected by this issue is the function IP_PMTUDISC_DO. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. CVE summarizes:

quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet. By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they're unable to establish a QUIC connection). The attacker needs to at least know the client's IP and port tuple to mount an attack. This vulnerability is fixed in 0.48.2.

The advisory is available at github.com. This vulnerability is handled as CVE-2024-53259 since 11/19/2024. The exploitation is known to be easy. The attack can only be done within the local network. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 234533 (Azure Linux 3.0 Security Update: coredns (CVE-2024-53259)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.48.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (234533). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• quic-go

Version

• 0.48.0
• 0.48.1

Website

• Product: https://github.com/quic-go/quic-go/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion