Issue summary: A malicious remote peer may flood the local QUIC
\nstack with NEW_CONNECTION_ID frames by avoiding a limit check on
\nhow many connection IDs the remote QUIC stack can use.<\/p>\n
Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame
\nfor every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID
\nframe is dispatched via the Control Frame Queue (CFQ). If the remote
\npeer also withholds ACKs, then it can force the local stack
\nto allocate ~400MB (depending on ACK delay).<\/p>\n
CWE: CWE-770: Allocation of Resources Without Limits or Throttling<\/p>\n
Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism
\nby which a remote peer can notify the local QUIC stack to change the
\ndestination connection ID (a.k.a. CID) the local stack uses to
\nidentify the connection at the remote peer. Each CID is associated
\nwith a sequence number. The sequence number is transmitted
\nin NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID
\nwhich is being either associated with a connection or retired.<\/p>\n
The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know
\na new CID is being associated with an existing connection. The
\nNEW_CONNECTION_ID frame carries the new CID, its sequence number, and the
\nretire-prior-to number. The retire-prior-to identifies existing
\nCIDs that are to be retired. The local QUIC stack must send a
\nRETIRE_CONNECTION_ID for every destination CID whose sequence number
\nis less than retire-prior-to. The CID becomes retired after the
\nlocal stack receives an ACK for its RETIRE_CONNECTION_ID frame.<\/p>\n
Although the OpenSSL QUIC stack supports at most one destination CID
\nfor every connection, it can be tricked into processing more than
\none RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC
\nstack currently retires the destination CID as soon as it receives
\nthe NEW_CONNECTION_ID, while in fact the destination CID must
\nbe retired after an ACK for the RETIRE_CONNECTION_ID frame is received.
\nCorrecting the flawed logic also fixes the backlog growth.<\/p>\n
[1] https:\/\/datatracker.ietf.org\/doc\/html\/rfc9000#name-issuing-connection-ids<\/p>\n
FIPS impact: no
\nThe FIPS module is not affected as the QUIC implementation is outside of
\nthe OpenSSL FIPS module boundary.<\/p>\n","protected":false},"excerpt":{"rendered":"
Issue summary: A malicious remote peer may flood the local QUIC
\nstack with NEW_CONNECTION_ID frames by avoiding a limit check on
\nhow many connection IDs the remote QUIC stack can use.<\/p>\n
Impact summary:<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-30634","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/30634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}