Description

quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.

INFO

Published Date :

2024-04-04T14:25:43.663Z

Last Modified :

2024-08-23T19:29:41.592Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-22189 vulnerability.

Vendors Products
Redhat
  • Acm
  • Ansible Automation Platform
  • Openshift
  • Service Mesh
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-22189.

URL Resource
https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c85ed47a cve-icon cve-icon cve-icon cve-icon
https://github.com/quic-go/quic-go/security/advisories/GHSA-c33x-xqrf-c478 cve-icon cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-22189 cve-icon
https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-management cve-icon cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-22189 cve-icon
https://www.youtube.com/watch?v=JqXtYcZAtIA&t=3683s cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact