CVE-2024-28854 Slow loris vulnerability with default configuration in tls-listener
A malicious user can cause a denial of service in services using the tls-listener library by opening many TCP connections with zero bytes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28854?
CVE-2024-28854 is a high-severity denial of service vulnerability in tmccombs tls-listener, published on 15 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 `TcpStream`s a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using `TlsListener::new()` vulnerable to a slow-loris DoS attack. This impacts any publicly accessible service using the default configuration of tls-listener in versions prior to 0.10.0. Users are advised to upgrade. Users unable to upgrade may mitigate this by passing a large value, such as `usize::MAX` as the parameter to `Builder::max_handshakes`.
Weakness: CWE-400
Which versions are affected by CVE-2024-28854?
3 open source packages ship an affected version, including tls-listener. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tls-listener crates.io | All versions | 0.10.0 |
tls-listener crates.io | All versions | 0.10.0 |
tls-listener crates.io | From 0.0.0-0 | 0.10.0 |
Products include Tmccombs Tls-Listener.
How do I fix CVE-2024-28854?
Upgrade tls-listener to 0.10.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-28854 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28854 exists.
Sources
Also known as GHSA-2qph-qpvm-2qf7, RUSTSEC-2024-0341.