Summary
AWS Common Runtime aws-c-http is a HTTP client library used by AWS SDKs for handling http requests to AWS services.
Improper handling of HPACK dynamic table size updates within the library might allow a remote threat actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execution, via a crafted sequence of HTTP/2 HEADERS frames.
Impact
When an HTTP/2 client built with aws-c-http connects to an distrust server, the server can send HEADERS frames containing HPACK dynamic table size updates that leverage a buffer growth issue in the HPACK decoder. Specifically, a dynamic table size update that shrinks the table to a very small capacity (e.g., 1 entry) causes the internal buffer to resize accordingly. A subsequent size update back to a larger value triggers the buffer growth path, but the 1.5x growth factor truncates to the same size when the current capacity is 1 (integer truncation: 1 * 1.5 = 1). The decoder proceeds as if growth succeeded, with a ring buffer to store the table, it causes multiple logical entries to point the same buffer slot. On cleanup, this results in a heap double-free, potentially leading to denial of service or arbitrary code execution.
This issue can only be leveraged when the client connects to a server controlled by the an actor over HTTP/2.
Impacted versions:
aws-c-http [>= 0.4.22 AND <= 0.10.15]
exposed in following sdk versions:
aws-sdk-cpp [>= 1.11.41, <= 1.11.814]
aws-sdk-java-v2 [>= 2.44.27, <= 2.44.14]
Patches
This issue has been addressed in aws-c-http version 0.11.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds
Force HTTP/1.1 connections where available. HTTP/1.1 does not use HPACK header compression and is not affected by this issue. Consult your SDK's documentation for how to disable HTTP/2 negotiation (e.g., by not enabling h2 in ALPN configuration).
References
If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Summary
AWS Common Runtime aws-c-http is a HTTP client library used by AWS SDKs for handling http requests to AWS services.
Improper handling of HPACK dynamic table size updates within the library might allow a remote threat actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execution, via a crafted sequence of HTTP/2 HEADERS frames.
Impact
When an HTTP/2 client built with aws-c-http connects to an distrust server, the server can send HEADERS frames containing HPACK dynamic table size updates that leverage a buffer growth issue in the HPACK decoder. Specifically, a dynamic table size update that shrinks the table to a very small capacity (e.g., 1 entry) causes the internal buffer to resize accordingly. A subsequent size update back to a larger value triggers the buffer growth path, but the 1.5x growth factor truncates to the same size when the current capacity is 1 (integer truncation: 1 * 1.5 = 1). The decoder proceeds as if growth succeeded, with a ring buffer to store the table, it causes multiple logical entries to point the same buffer slot. On cleanup, this results in a heap double-free, potentially leading to denial of service or arbitrary code execution.
This issue can only be leveraged when the client connects to a server controlled by the an actor over HTTP/2.
Impacted versions:
aws-c-http [>= 0.4.22 AND <= 0.10.15]
exposed in following sdk versions:
aws-sdk-cpp [>= 1.11.41, <= 1.11.814]
aws-sdk-java-v2 [>= 2.44.27, <= 2.44.14]
Patches
This issue has been addressed in aws-c-http version 0.11.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds
Force HTTP/1.1 connections where available. HTTP/1.1 does not use HPACK header compression and is not affected by this issue. Consult your SDK's documentation for how to disable HTTP/2 negotiation (e.g., by not enabling h2 in ALPN configuration).
References
If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.