Undetected Panic in QUIC Server Due to Unvalidated Connections

CVE-2024-45311

What is CVE-2024-45311?

The Quinn library, which implements the IETF QUIC transport protocol using Rust, is susceptible to a vulnerability that can lead to server stability issues related to connection handling. Specifically, when a server attempts to 'retry()' an unvalidated incoming connection, it exposes itself to potential panic scenarios. This occurs under certain conditions; for instance, if a duplicate initial packet is encountered after 'refuse()' or 'ignore()' actions. Additionally, an accepted connection may fail to decrypt if a similar initial packet that successfully decrypts has already been processed. Although the first scenario has been noted in practical applications, the second scenario remains theoretical, contingent upon client behavior. Careful validation and handling routines are crucial to ensuring server resilience against these potential vulnerabilities.

References