Skip to content

Commit 6651075

Browse files
zpavlinoviczpavlinovic
committed
data/reports: add GO-2024-2682.yaml
Aliases: CVE-2024-22189, GHSA-c33x-xqrf-c478 Fixes #2682 Change-Id: I298961e72d34e367f5070f9f55dd02e8b6120b5f Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/576755 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Damien Neil <[email protected]> Run-TryBot: Zvonimir Pavlinovic <[email protected]> TryBot-Result: Gopher Robot <[email protected]>
1 parent 1131f42 commit 6651075

File tree

2 files changed

+180
-0
lines changed

2 files changed

+180
-0
lines changed

‎data/osv/GO-2024-2682.json

+106
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2682",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-22189",
8+
"GHSA-c33x-xqrf-c478"
9+
],
10+
"summary": "Denial of service via connection starvation in github.com/quic-go/quic-go",
11+
"details": "An attacker can cause its peer to run out of memory by sending a large number of NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRE_CONNECTION_ID frame. The attacker can prevent the receiver from sending out (the vast majority of) these RETIRE_CONNECTION_ID frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/quic-go/quic-go",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.42.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/quic-go/quic-go",
35+
"symbols": [
36+
"Dial",
37+
"DialAddr",
38+
"DialAddrEarly",
39+
"DialEarly",
40+
"Listen",
41+
"ListenAddr",
42+
"ListenAddrEarly",
43+
"ListenEarly",
44+
"Transport.Dial",
45+
"Transport.DialEarly",
46+
"Transport.Listen",
47+
"Transport.ListenEarly",
48+
"connIDGenerator.Retire",
49+
"connIDGenerator.SetMaxActiveConnIDs",
50+
"connIDManager.Add",
51+
"connIDManager.Get",
52+
"connection.AcceptStream",
53+
"connection.AcceptUniStream",
54+
"connection.OpenStream",
55+
"connection.OpenStreamSync",
56+
"connection.OpenUniStream",
57+
"connection.OpenUniStreamSync",
58+
"connection.run",
59+
"framerI.AppendStreamFrames",
60+
"framerI.QueueControlFrame",
61+
"packetPacker.AppendPacket",
62+
"packetPacker.MaybePackProbePacket",
63+
"packetPacker.PackAckOnlyPacket",
64+
"packetPacker.PackApplicationClose",
65+
"packetPacker.PackCoalescedPacket",
66+
"packetPacker.PackConnectionClose",
67+
"packetPacker.PackMTUProbePacket",
68+
"receiveStream.CancelRead",
69+
"receiveStream.CloseRemote",
70+
"receiveStream.Read",
71+
"sendStream.CancelWrite",
72+
"streamsMap.AcceptStream",
73+
"streamsMap.AcceptUniStream",
74+
"streamsMap.DeleteStream",
75+
"streamsMap.HandleMaxStreamsFrame",
76+
"streamsMap.OpenStream",
77+
"streamsMap.OpenStreamSync",
78+
"streamsMap.OpenUniStream",
79+
"streamsMap.OpenUniStreamSync",
80+
"streamsMap.UpdateLimits",
81+
"windowUpdateQueue.QueueAll"
82+
]
83+
}
84+
]
85+
}
86+
}
87+
],
88+
"references": [
89+
{
90+
"type": "FIX",
91+
"url": "https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c85ed47a"
92+
},
93+
{
94+
"type": "WEB",
95+
"url": "https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-management"
96+
}
97+
],
98+
"credits": [
99+
{
100+
"name": "marten-seemann"
101+
}
102+
],
103+
"database_specific": {
104+
"url": "https://pkg.go.dev/vuln/GO-2024-2682"
105+
}
106+
}

‎data/reports/GO-2024-2682.yaml

+74
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
id: GO-2024-2682
2+
modules:
3+
- module: github.com/quic-go/quic-go
4+
versions:
5+
- fixed: 0.42.0
6+
vulnerable_at: 0.41.0
7+
packages:
8+
- package: github.com/quic-go/quic-go
9+
symbols:
10+
- framerI.QueueControlFrame
11+
- connection.run
12+
derived_symbols:
13+
- Dial
14+
- DialAddr
15+
- DialAddrEarly
16+
- DialEarly
17+
- Listen
18+
- ListenAddr
19+
- ListenAddrEarly
20+
- ListenEarly
21+
- Transport.Dial
22+
- Transport.DialEarly
23+
- Transport.Listen
24+
- Transport.ListenEarly
25+
- connIDGenerator.Retire
26+
- connIDGenerator.SetMaxActiveConnIDs
27+
- connIDManager.Add
28+
- connIDManager.Get
29+
- connection.AcceptStream
30+
- connection.AcceptUniStream
31+
- connection.OpenStream
32+
- connection.OpenStreamSync
33+
- connection.OpenUniStream
34+
- connection.OpenUniStreamSync
35+
- framerI.AppendStreamFrames
36+
- packetPacker.AppendPacket
37+
- packetPacker.MaybePackProbePacket
38+
- packetPacker.PackAckOnlyPacket
39+
- packetPacker.PackApplicationClose
40+
- packetPacker.PackCoalescedPacket
41+
- packetPacker.PackConnectionClose
42+
- packetPacker.PackMTUProbePacket
43+
- receiveStream.CancelRead
44+
- receiveStream.CloseRemote
45+
- receiveStream.Read
46+
- sendStream.CancelWrite
47+
- streamsMap.AcceptStream
48+
- streamsMap.AcceptUniStream
49+
- streamsMap.DeleteStream
50+
- streamsMap.HandleMaxStreamsFrame
51+
- streamsMap.OpenStream
52+
- streamsMap.OpenStreamSync
53+
- streamsMap.OpenUniStream
54+
- streamsMap.OpenUniStreamSync
55+
- streamsMap.UpdateLimits
56+
- windowUpdateQueue.QueueAll
57+
summary: Denial of service via connection starvation in github.com/quic-go/quic-go
58+
description: |-
59+
An attacker can cause its peer to run out of memory by sending a large number of
60+
NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is
61+
supposed to respond to each retirement frame with a RETIRE_CONNECTION_ID frame.
62+
The attacker can prevent the receiver from sending out (the vast majority of)
63+
these RETIRE_CONNECTION_ID frames by collapsing the peers congestion window (by
64+
selectively acknowledging received packets) and by manipulating the peer's RTT
65+
estimate.
66+
cves:
67+
- CVE-2024-22189
68+
ghsas:
69+
- GHSA-c33x-xqrf-c478
70+
credits:
71+
- marten-seemann
72+
references:
73+
- fix: https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c85ed47a
74+
- web: https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-management

0 commit comments

Comments
 (0)