CVE-2023-49295 — Uncontrolled Resource Consumption in Quic-go

CWE-400 — Uncontrolled Resource Consumption9 documents7 sources
Severity
6.5MEDIUMNVD
CNA6.4
EPSS
1.8%
top 17.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Quic-goGithub.com Quic-go Quic-goQuic-go Project Quic-go
Timeline
PublishedJan 10
Latest updateJan 23

Description

quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5quic-go/quic-go< 0.37.7+3
▶NVDquic-go_project/quic-go0.38.0 — 0.38.2+3
▶Gogithub.com/quic-go_quic-go0.38.0 — 0.38.2+3

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
Denial of service via path validation in github.com/quic-go/quic-go↗2024-01-23
▶
OSV
CVE-2023-49295: quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go↗2024-01-10
▶
GHSA
quic-go's path validation mechanism can be exploited to cause denial of service↗2024-01-10
▶
OSV
quic-go's path validation mechanism can be exploited to cause denial of service↗2024-01-10
▶
CVEList
quic-go's path validation mechanism can cause denial of service↗2024-01-10
▶

📋Vendor Advisories

3
Red Hat
quic-go: memory exhaustion attack against QUIC's path validation mechanism↗2024-01-10
▶
Microsoft
quic-go's path validation mechanism can cause denial of service↗2024-01-09
▶
Debian
CVE-2023-49295: golang-github-lucas-clemente-quic-go - quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002)...↗2023
▶
CVE-2023-49295 — Uncontrolled Resource Consumption | cvebase