CVE-2024-45311
Publiée le 2024-09-02 · Dernière modification le 2026-06-17
Les serveurs utilisant l'implémentation Rust « Quinn » du protocole QUIC sont susceptibles de subir un plantage entraînant un déni de service. Un attaquant distant non authentifié peut déclencher cet incident en envoyant des paquets réseau spécialement conçus, sans qu'aucune interaction de l'utilisateur ne soit nécessaire. Cela permet à un tiers de mettre votre service hors ligne avec un effort relativement faible.
DÉTAIL DU VECTEUR CVSS
RÉFÉRENCES
Description officielle du NVD (en anglais)
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to `accept()`, `retry()`, `refuse()`, or `ignore()` an `Incoming` connection. However, calling `retry()` on an unvalidated connection exposes the server to a likely panic in the following situations: 1. Calling `refuse` or `ignore` on the resulting validated connection, if a duplicate initial packet is received. This issue can go undetected until a server's `refuse()`/`ignore()` code path is exercised, such as to stop a denial of service attack. 2. Accepting when the initial packet for the resulting validated connection fails to decrypt or exhausts connection IDs, if a similar initial packet that successfully decrypts and doesn't exhaust connection IDs is received. This issue can go undetected if clients are well-behaved. The former situation was observed in a real application, while the latter is only theoretical.