CVE-2024-45311 Denial of service in quinn-proto when using `Endpoint::retry()`
A remote attacker can cause a server panic and denial of service by sending specific duplicate or malformed initial packets to a QUIC server using the quinn-proto library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45311?
CVE-2024-45311 is a high-severity denial of service vulnerability in quinn-rs quinn, published on 2 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to `accept()`, `retry()`, `refuse()`, or `ignore()` an `Incoming` connection. However, calling `retry()` on an unvalidated connection exposes the server to a likely panic in the following situations: 1. Calling `refuse` or `ignore` on the resulting validated connection, if a duplicate initial packet is received. This issue can go undetected until a server's `refuse()`/`ignore()` code path is exercised, such as to stop a denial of service attack. 2. Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received. This issue can go undetected if clients are well-behaved. The former situation was observed in a real application, while the latter is only theoretical.
Weakness: CWE-670
Which versions are affected by CVE-2024-45311?
3 open source packages ship an affected version, including quinn-proto. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
quinn-proto crates.io | From 0.11.0 | 0.11.7 |
quinn-proto crates.io | From 0.11.0 | 0.11.7 |
quinn-proto crates.io | From 0.11.0 | 0.11.7 |
Products include Quinn Project Quinn.
How do I fix CVE-2024-45311?
Upgrade quinn-proto to 0.11.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-45311 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45311 exists.
Other vulnerabilities in quinn-rs quinn
Sources
Also known as GHSA-vr26-jcq5-fjj8, RUSTSEC-2024-0373.