CVE-2024-53259

描述

quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet. By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they're unable to establish a QUIC connection). The attacker needs to at least know the client's IP and port tuple to mount an attack. This vulnerability is fixed in 0.48.2.

如何修補 CVE-2024-53259

要修補 CVE-2024-53259,請將受影響套件升級到下列已修補版本。

• —未列出修補版本
• —升級至 0.48.2 或更新版本
• —升級至 0.48.2 或更新版本

CVE-2024-53259 正在被利用嗎?

低 — EPSS 為 0.6%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• from 0
• from 0, < 0.48.2
• from 0, < 0.48.2

CVSS 分數

參考連結(8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-53259
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2024-53259
• PATCHgithub.com/quic-go/quic-go
• REPORTdatatracker.ietf.org/doc/draft-seemann-tsvwg-udp-fragmentation/