GHSA-9q54-f358-3fqf: Medium severity rust/s2n-quic vulnerability
s2n-quic is a Rust implementation of the QUIC protocol. An unauthenticated user can attempt to exhaust server memory on an s2n-quic endpoint by sending crafted CRYPTO frames with high offsets. The buffer used for processing CRYPTO frames does not enforce a maximum size. In the worst case, a single 1200-byte packet can cause approximately 9.4 MB of allocation. By repeatedly sending such packets, the resulting memory pressure could cause denial of service. No valid handshake is required.
Impacted versions: <= v1.81.0
Patches This issue has been addressed in s2n-quic version v1.82.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds There is no workaround that fully mitigates this issue. Upgrading to the patched version is the recommended remediation.
References If there are any questions or comments about this advisory, contact AWS Security via the vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/s2n-quicto a version that resolves this vulnerability.Fixed in 1.82.0 - Upgrade
Upgrade
s2n-quicto a version that resolves this vulnerability.Fixed in v1.82.0
Event History
Frequently Asked Questions
What is the severity of GHSA-9q54-f358-3fqf?
The severity of GHSA-9q54-f358-3fqf is classified as medium with a score of 5.3.
How do I fix GHSA-9q54-f358-3fqf?
To fix GHSA-9q54-f358-3fqf, ensure you are using the latest version of rust/s2n-quic where memory exhaustion vulnerabilities have been addressed.
What vulnerabilities are associated with GHSA-9q54-f358-3fqf?
GHSA-9q54-f358-3fqf is associated with an unauthenticated memory exhaustion issue via crafted CRYPTO frames.
Who is affected by GHSA-9q54-f358-3fqf?
Any user or server utilizing the rust/s2n-quic implementation of the QUIC protocol may be affected by GHSA-9q54-f358-3fqf.
What components are involved in GHSA-9q54-f358-3fqf?
The components involved in GHSA-9q54-f358-3fqf primarily include the s2n-quic library used for QUIC protocol implementation.