CVE-2023-49295 quic-go's path validation mechanism can cause denial of service
An attacker can exhaust memory in quic-go by sending excessive PATH_CHALLENGE frames, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-49295?
CVE-2023-49295 is a medium-severity denial of service vulnerability in quic-go, published on 10 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer to run out of memory sending a large number of PATH_CHALLENGE frames. The receiver is supposed to respond to each PATH_CHALLENGE frame with a PATH_RESPONSE frame. The attacker can prevent the receiver from sending out (the vast majority of) these PATH_RESPONSE frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. This vulnerability has been patched in versions 0.37.7, 0.38.2 and 0.39.4.
Weakness: CWE-400
Which versions are affected by CVE-2023-49295?
9 open source packages ship an affected version, including github.com/quic-go/quic-go. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/quic-go/quic-go Go | All versions | 0.37.7, 0.38.2, 0.39.4, 0.40.1 |
github.com/quic-go/quic-go Go | All versions | 0.37.7 |
github.com/quic-go/quic-go Go | All versions | 0.37.7 |
github.com/quic-go/quic-go Go | From 0.38.0 | 0.38.2 |
github.com/quic-go/quic-go Go | From 0.38.0 | 0.38.2 |
github.com/quic-go/quic-go Go | From 0.39.0 | 0.39.4 |
3 more packages
github.com/quic-go/quic-go Go | From 0.39.0 | 0.39.4 |
github.com/quic-go/quic-go Go | From 0.40.0 | 0.40.1 |
github.com/quic-go/quic-go Go | From 0.40.0 | 0.40.1 |
Linux distribution packages (7)
receptor Red Hat:ansible_automation_platform:2.4::el8 | All versions | 0:1.4.4-1.el8ap |
receptor Red Hat:ansible_automation_platform:2.4::el9 | All versions | 0:1.4.4-1.el9ap |
receptor Red Hat:ansible_automation_platform_developer:2.4::el8 | All versions | 0:1.4.4-1.el8ap |
receptor Red Hat:ansible_automation_platform_developer:2.4::el9 | All versions | 0:1.4.4-1.el9ap |
receptor Red Hat:ansible_automation_platform_inside:2.4::el8 | All versions | 0:1.4.4-1.el8ap |
receptor Red Hat:ansible_automation_platform_inside:2.4::el9 | All versions | 0:1.4.4-1.el9ap |
kubo openSUSE:Tumbleweed | All versions | 0.32.1-1.1 |
Products include Quic-Go Project Quic-Go.
How do I fix CVE-2023-49295?
Upgrade github.com/quic-go/quic-go to a fixed version for your release line: 0.37.7, 0.38.2, 0.39.4 or 0.40.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-49295 being exploited?
There is no known exploitation of CVE-2023-49295 in the wild and no public exploit code.
Other vulnerabilities in quic-go
Sources
Also known as AZL-33285, AZL-34627, DEBIAN-CVE-2023-49295, GHSA-ppxx-5m9h-6vxf, GO-2024-2459, RHSA-2024:0855 and 3 more.