CVE-2025-24356: UDP traffic amplification via fastd's fast reconnect feature
First published: Mon Jan 27 2025(Updated: )
fastd is a VPN daemon which tunnels IP packets and Ethernet frames over UDP. When receiving a data packet from an unknown IP address/port combination, fastd will assume that one of its connected peers has moved to a new address and initiate a reconnect by sending a handshake packet. This "fast reconnect" avoids having to wait for a session timeout (up to ~90s) until a new connection is established. Even a 1-byte UDP packet just containing the fastd packet type header can trigger a much larger handshake packet (~150 bytes of UDP payload). Including IPv4 and UDP headers, the resulting amplification factor is roughly 12-13. By sending data packets with a spoofed source address to fastd instances reachable on the internet, this amplification of UDP traffic might be used to facilitate a Distributed Denial of Service attack. This vulnerability is fixed in v23.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| fastd | <v23 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/neocturne/fastd/security/advisories/GHSA-pggg-vpfv-4rcv
- https://github.com/neocturne/fastd/commit/1f233bee76b722c0b3f9024f2c39c72e9f7e5843
- https://github.com/neocturne/fastd/commit/3940150e801d0c91460491bec32cbcc5bbc89d5f
- https://github.com/neocturne/fastd/commit/5f63fcfc18ae9cad023fa463b152d5e14192b5a8
- https://github.com/neocturne/fastd/commit/9df7e516378441d2d17b89f9db5c27c8312d8f12
- https://github.com/neocturne/fastd/commit/c1a07b3f2b9066c3713c68547da700b85d60f4f7
- https://github.com/neocturne/fastd/commit/ce1b79b12dbfa796743b5f3a50789ade965b7023
- https://github.com/neocturne/fastd/commit/d03a0a17347efb5293e42fde7d982781e90f14ef
Frequently Asked Questions
What is the severity of CVE-2025-24356?
CVE-2025-24356 is considered a medium severity vulnerability.
How do I fix CVE-2025-24356?
To fix CVE-2025-24356, upgrade fastd to a version later than v23.
What is the impact of CVE-2025-24356 on fastd?
CVE-2025-24356 allows an attacker to initiate a false peer handshake by sending packets from a spoofed IP address.
Which versions of fastd are affected by CVE-2025-24356?
CVE-2025-24356 affects fastd versions prior to v23.
Where can I find more information about CVE-2025-24356?
Detailed information about CVE-2025-24356 can be found in the fastd security advisories.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- agent/event
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/epss
- collector/epss-latest
- source/FIRST
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/fastd
- canonical/fastd