Vulnerability · Published Dec 2, 2024 · Assigned by GitHub_M
CVE-2024-53259quic-go affected by an ICMP Packet Too Large Injection Attack on Linux
Medium 6.5
In plain English
A medium-severity insufficient verification of data authenticity in quic-go from quic-go. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet. By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they're unable to establish a QUIC connection). The attacker needs to at least know the client's IP and port tuple to mount an attack. This vulnerability is fixed in 0.48.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-lucas-clemente-quic-go | no fix listed | DEBIAN-CVE-2024-53259 |
| Debian:13 | golang-github-lucas-clemente-quic-go | 0.50.0-1 | DEBIAN-CVE-2024-53259 |
| Debian:14 | golang-github-lucas-clemente-quic-go | 0.50.0-1 | DEBIAN-CVE-2024-53259 |
| Go | github.com/quic-go/quic-go | 0.48.2 | GHSA-px8v-pp82-rcvr |
| Go | github.com/quic-go/quic-go | 0.48.2 | GO-2024-3302 |
| Ubuntu:22.04:LTS | golang-github-lucas-clemente-quic-go | no fix listed | UBUNTU-CVE-2024-53259 |
| Ubuntu:24.04:LTS | golang-github-lucas-clemente-quic-go | no fix listed | UBUNTU-CVE-2024-53259 |
| Ubuntu:25.10 | golang-github-lucas-clemente-quic-go | no fix listed | UBUNTU-CVE-2024-53259 |
| Ubuntu:26.04:LTS | golang-github-lucas-clemente-quic-go | no fix listed | UBUNTU-CVE-2024-53259 |
| Ubuntu:26.10 | golang-github-lucas-clemente-quic-go | no fix listed | UBUNTU-CVE-2024-53259 |
Affected products (as reported)
Weakness: CWE-345 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/quic-go/quic-go/security/advisories/GHSA-px8v-pp82-rcvr x_refsource_CONFIRM
- https://github.com/quic-go/quic-go/pull/4729 x_refsource_MISC
- https://github.com/quic-go/quic-go/commit/ca31dd355cbe5fc6c5807992d9d1149c66c96a50 x_refsource_MISC
- https://github.com/quic-go/quic-go/releases/tag/v0.48.2 x_refsource_MISC