github.com
https://github.com/cloudflare/quiche CVE-2024-1765
MEDIUM
Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche
Record summary
CVE-2024-1765 has a selected CVSS score of 5.9 (medium).
Description
Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after previously completing the QUIC handshake. Exploitation was possible for the duration of the connection which could be extended by the attacker. quiche 0.19.2 and 0.20.1 are the earliest versions containing the fix for this issue.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 13, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unaffected | CVE List | 0.15.0 to ≤ <0.19.1 | affected |
| 0.20.0 to < <0.20.1 | affected | ||
| GitHub Advisory | Before 0.19.2 · Fixed in 0.19.2 | affected | |
| 0.20.0 to < 0.20.1 · Fixed in 0.20.1 | affected |
References
7github.com
https://github.com/cloudflare/quiche/commit/1017466c143fc93a82b286a1ba35e53334cdf8e2 github.com
https://github.com/cloudflare/quiche/commit/11dbf5461ab657bbc02e466d719070124b27ef3c github.com
https://github.com/cloudflare/quiche/releases/tag/0.19.2 github.com
https://github.com/cloudflare/quiche/releases/tag/0.20.1 github.com
https://github.com/cloudflare/quiche/security/advisories/GHSA-78wx-jg4j-5j6g nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-1765