GHSA-hxq4-mx37-fqvg s2n-quic potential denial of service vulnerability when receiving empty UDP packets
An attacker can cause a denial of service by sending empty UDP packets to applications using the s2n-quic library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-hxq4-mx37-fqvg?
GHSA-hxq4-mx37-fqvg is a denial of service vulnerability in s2n-quic, published on 30 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
An issue in s2n-quic results in the endpoint shutting down after receiving an empty UDP packet on a connection.
No AWS services are affected by this issue and customers of AWS services do not need to take action. Applications using s2n-quic should upgrade their application to the most recent release of s2n-quic.
Impacted version: s2n-quic v1.22.0.
Patches
The patch is included in s2n-quic v1.23.0.
If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page or directly via email to [email protected]. Please do not create a public GitHub issue.
Which versions are affected by GHSA-hxq4-mx37-fqvg?
2 open source packages ship an affected version, including s2n-quic.
| Package | Affected | Fixed in |
|---|---|---|
s2n-quic crates.io | From 1.22.0 | 1.23.0 |
s2n-quic crates.io | From 1.22.0 | 1.23.0 |
How do I fix GHSA-hxq4-mx37-fqvg?
Upgrade s2n-quic to 1.23.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-hxq4-mx37-fqvg being exploited?
There is no known exploitation of GHSA-hxq4-mx37-fqvg in the wild and no public exploit code.