GHSA-hxp2-xqf3-v83h Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
A remote attacker can crash the application by sending a malformed Server Hello request, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-hxp2-xqf3-v83h?
GHSA-hxp2-xqf3-v83h is a denial of service vulnerability in github.com/pion/dtls, published on 7 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
When attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash.
This issue could be abused to cause a denial of service.
Workaround
None
Which versions are affected by GHSA-hxp2-xqf3-v83h?
5 open source packages ship an affected version, including github.com/pion/dtls/v2 and github.com/pion/dtls.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pion/dtls/v2 Go | All versions | 2.2.4 |
github.com/pion/dtls/v2 Go | All versions | 2.2.4 |
github.com/pion/dtls/v2 Go | All versions | 2.2.4 |
github.com/pion/dtls Go | All versions to 1.5.4 | None |
github.com/pion/dtls Go | All versions to 1.5.4 | None |
How do I fix GHSA-hxp2-xqf3-v83h?
Upgrade github.com/pion/dtls/v2 to 2.2.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-hxp2-xqf3-v83h being exploited?
There is no known exploitation of GHSA-hxp2-xqf3-v83h in the wild and no public exploit code.
Sources
Also known as GO-2023-1535.