GitHub Advisoryadvisory · Go

GHSA-3q6m-v84f-6p9h quic-go vulnerable to pointer dereference that can lead to panic

HIGH Published 2023-10-30 Modified 2023-11-01 Official page ↗
Aliases
CVE-2023-46239
Ecosystem
Go
Packages
github.com/quic-go/quic-go
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-248, CWE-476
Reviewed
2023-10-30

Affected packages

• Go github.com/quic-go/quic-go: >= 0.37.0, < 0.37.3 → fixed in 0.37.3

Description

quic-go is an implementation of the QUIC transport protocol in Go. By serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. Impact An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Patches v0.37.3 contains a patch. Versions before v0.37.0 are not affected.

Related

Alias · CVE (1)

  • CVE-2023-46239 quic-go is an implementation of the QUIC protocol in Go. vulnerability

Weakness · CWE (2)

  • CWE-248 Uncaught Exception weakness
  • CWE-476 NULL Pointer Dereference weakness

References