CVE-2023-39322: Memory exhaustion in QUIC connection handling in crypto/tls
Golang Go is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw when reading post-handshake messages. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause unbounded memory growth, and results in a denial of service condition.
Other sources
Once the TLS handshake completes, QUICConn.HandleData buffers data and passes it to handlePostHandshakeMessage every time the buffer contains a complete message. The size check is wrong, however, so it can pass along a partial message, triggering a panic when handlePostHandshakeMessage tries to read the remainder of the message.
In addition, HandleData doesn't limit the amount of data it can buffer. It should reject messages larger than maxHandshake.
— Red Hat
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-39322?
CVE-2023-39322 is a vulnerability that allows a malicious QUIC connection to cause unbounded memory growth by not setting an upper bound on the amount of data buffered when reading post-handshake messages.
How does CVE-2023-39322 affect Golang Go?
CVE-2023-39322 affects Golang Go versions 1.21.0 up to but not including 1.21.1.
What is the severity of CVE-2023-39322?
CVE-2023-39322 has a severity rating of 7.5 (high).
How can CVE-2023-39322 be fixed?
CVE-2023-39322 can be fixed by updating Golang Go to version 1.21.1 or higher.
What is the CWE of CVE-2023-39322?
CVE-2023-39322 has CWE (Common Weakness Enumeration) vulnerabilities 770 and 400.