Issue summary: QUIC server may double free QRX (QUIC record layer RX) object
\nwhen channel creation fails for initial packet.<\/p>\n
Impact summary: Double free leads to heap corruption, which typically results in
\ntermination of QUIC server process, leading to Denial of Service. There is so
\nfar no evidence that this double free is exploitable for remote code execution,
\nthus it is considered highly improbable.<\/p>\n
CWE: CWE-415: Double Free<\/p>\n
Description: In order to validate initial packet, OpenSSL QUIC stack default
\npacket handler (port_default_packet_handler()) creates a so-called QRX object.
\nIf the initial packet validates successfully with QRX object, the default packet
\nhandler proceeds to channel (connection object) creation. The QRX object used
\nfor packet validation is passed to port_bind_channel(), so it becomes part of
\nthe newly created connection. If port_bind_channel() fails, then it also frees
\nthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()
\ndetects the failure and proceeds to the error branch, where the same QRX object is
\nfreed for the second time.<\/p>\n
The failure in port_bind_channel() function can be induced with a relatively
\nlow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet
\ncarries DCID (destination connection ID) which is shorter than 8 bytes, then
\nport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()
\ndetects that the DCID has invalid length.<\/p>\n
FIPS impact: no
\nThe FIPS module is not affected, as the QUIC implementation is outside of
\nthe OpenSSL FIPS module boundary.<\/p>\n","protected":false},"excerpt":{"rendered":"
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object
\nwhen channel creation fails for initial packet.<\/p>\n
Impact summary: Double free leads to heap corruption, which typically resu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11557","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11557","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11557"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11557"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11557"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}