quic-go vulnerable to pointer dereference that can lead to panic
Package
Affected versions
>= 0.37.0, < 0.37.3
Patched versions
0.37.3
Description
Published to the GitHub Advisory Database
Oct 30, 2023
Reviewed
Oct 30, 2023
Published by the National Vulnerability Database
Oct 31, 2023
Last updated
Nov 9, 2023
quic-go is an implementation of the QUIC transport protocol in Go. By serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space.
Impact
An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets.
Patches
v0.37.3 contains a patch. Versions before v0.37.0 are not affected.
References