CVE-2021-24029: High severity Facebook Mvfst vulnerability
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-24029?
CVE-2021-24029 is a vulnerability that allows for a packet of death scenario in mvfst, leading to a crash via a failed assertion during a QUIC session.
What is the severity of CVE-2021-24029?
The severity of CVE-2021-24029 is high, with a severity value of 7.5.
How does CVE-2021-24029 affect mvfst?
CVE-2021-24029 affects mvfst versions prior to commit a67083ff4b8dc. It allows for a packet of death scenario, causing a crash via a failed assertion during a QUIC session.
How does CVE-2021-24029 affect Microsoft Windows Server 2022?
CVE-2021-24029 affects Microsoft Windows Server 2022 with proxygen versions prior to 2021.03.15.00. It allows for a packet of death scenario, causing a crash via a failed assertion during a QUIC session.
How can I fix CVE-2021-24029?
To fix CVE-2021-24029, upgrade to mvfst commit a67083ff4b8dc or later for mvfst, and upgrade to proxygen version 2021.03.15.00 or later for Microsoft Windows Server 2022.