GHSA-2x7m-gf85-3745 Remote Denial of Service Vulnerability in Microsoft QUIC

Not scored Published 13 Mar 2024

Remote attackers can cause a denial of service in Microsoft QUIC servers by triggering a memory leak through multiple decodes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-2x7m-gf85-3745?

GHSA-2x7m-gf85-3745 is a denial of service vulnerability in Microsoft.Native.Quic.MsQuic.OpenSSL, published on 13 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Impact

The MsQuic server will continue to leak memory until no more is available, resulting in a denial of service.

Patches

The following patch was made:

Fix Memory Leak from Multiple Decodes of TP - https://github.com/microsoft/msquic/commit/5d070d661c45979946615289e92bb6b822efe9e9

Workarounds

Beyond upgrading to the patched versions, there is no other workaround.

MSRC CVE Info

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26190

Which versions are affected by GHSA-2x7m-gf85-3745?

12 open source packages ship an affected version, including Microsoft.Native.Quic.MsQuic.OpenSSL and Microsoft.Native.Quic.MsQuic.Schannel.

Package	Affected	Fixed in
`Microsoft.Native.Quic.MsQuic.OpenSSL` NuGet	All versions	`2.1.12`
`Microsoft.Native.Quic.MsQuic.OpenSSL` NuGet	All versions	`2.1.12`
`Microsoft.Native.Quic.MsQuic.OpenSSL` NuGet	From `2.2.0`	`2.2.7`
`Microsoft.Native.Quic.MsQuic.OpenSSL` NuGet	From `2.2.0`	`2.2.7`
`Microsoft.Native.Quic.MsQuic.OpenSSL` NuGet	From `2.3.0`	`2.3.5`
`Microsoft.Native.Quic.MsQuic.OpenSSL` NuGet	From `2.3.0`	`2.3.5`

6 more packages

`Microsoft.Native.Quic.MsQuic.Schannel` NuGet	All versions	`2.1.12`
`Microsoft.Native.Quic.MsQuic.Schannel` NuGet	All versions	`2.1.12`
`Microsoft.Native.Quic.MsQuic.Schannel` NuGet	From `2.2.0`	`2.2.7`
`Microsoft.Native.Quic.MsQuic.Schannel` NuGet	From `2.2.0`	`2.2.7`
`Microsoft.Native.Quic.MsQuic.Schannel` NuGet	From `2.3.0`	`2.3.5`
`Microsoft.Native.Quic.MsQuic.Schannel` NuGet	From `2.3.0`	`2.3.5`

How do I fix GHSA-2x7m-gf85-3745?

Upgrade Microsoft.Native.Quic.MsQuic.OpenSSL to a fixed version for your release line: 2.1.12, 2.2.7 or 2.3.5.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is GHSA-2x7m-gf85-3745 being exploited?

There is no known exploitation of GHSA-2x7m-gf85-3745 in the wild and no public exploit code.