GHSA-92f5-vc22-8j33: Use After Free
Summary Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Details
New network path creations and removals triggered by incoming packets can lead to a pointer invalidation.
Patches
- Guard path promotion e0f55b5
Impact
An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/Microsoft.Native.Quic.MsQuic.Schannelto a version that resolves this vulnerability.Fixed in 2.4.19 - Upgrade
Upgrade
nuget/Microsoft.Native.Quic.MsQuic.OpenSSLto a version that resolves this vulnerability.Fixed in 2.4.19 - Upgrade
Upgrade
nuget/Microsoft.Native.Quic.MsQuic.Schannelto a version that resolves this vulnerability.Fixed in 2.5.10 - Upgrade
Upgrade
nuget/Microsoft.Native.Quic.MsQuic.OpenSSLto a version that resolves this vulnerability.Fixed in 2.5.10 - Upgrade
Upgrade
Microsoft msquicto a version that resolves this vulnerability.Patch e0f55b5 - Compensating control
Restrict network access to the affected Microsoft QUIC service so unauthenticated attackers cannot send specially crafted packets to it over the network.
Event History
Frequently Asked Questions
Which deployments are exposed to network-based exploitation?
Services using the affected Microsoft.Native.Quic.MsQuic.Schannel or Microsoft.Native.Quic.MsQuic.OpenSSL packages are exposed if they accept QUIC traffic from an attacker over the network. The vulnerability does not require authentication or user interaction.
What must an attacker do to exploit the issue?
An attacker must send a specially crafted packet to an affected service. Incoming packets that trigger new network path creation and removal can cause pointer invalidation, enabling use-after-free conditions and potential code execution.
Is there a patch available?
Yes. The available patch guards path promotion and is identified by commit e0f55b5fdc9fff0b4465976d066ebd22fb7e2b3b.