Listen to this Post
How the CVE Works:
The vulnerability exists in the quic-go library’s HTTP/3 implementation. It improperly handles QPACK header compression. An attacker sends a specially crafted, small QPACK-encoded HEADERS frame. This frame references long header names and values stored in the static QPACK table. During decoding, these references expand dramatically, creating a massive `http.Header` map in memory. While the library enforced a limit on the compressed frame size (e.g., 1MB), it did not enforce any limit on the decompressed, in-memory header section. A single small frame could decode into tens of megabytes of header data, causing memory exhaustion and a Denial-of-Service (DoS) crash in both client and server implementations.
DailyCVE Form:
Platform: quic-go
Version: < 0.40.1
Vulnerability: Memory Exhaustion
Severity: Critical
date: 2024-01-25
Prediction: 2024-01-26
What Undercode Say:
$ git clone https://github.com/quic-go/quic-go
$ cd quic-go
$ git log --oneline v0.40.0...v0.40.1 --grep="header"
$ go version -m /path/to/binary | grep quic-go
// Vulnerable code concept (simplified):
func (d qpackDecoder) DecodeFull(frame []byte) (http.Header, error) {
var h http.Header
for processField() {
name := resolveStaticTable(ref) // Could be very long
value := resolveStaticTable(ref) // Could be very long
h.Add(name, value) // Memory grows unbounded
}
return h, nil // No size check on final 'h'
}
How Exploit:
h3_client --target <victim_server> \ --craft-headers \ --exploit CVE-2023-49295 \ --send Crafts a small QPACK frame causing massive memory allocation.
Protection from this CVE:
Update to quic-go v0.40.1+. Configure SettingsMaxFieldSectionSize. Implement redundant ingress memory limits.
Impact:
Remote DoS. Service Crash. Memory Exhaustion.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
