NULL pointer dereference in Quic-Go
CVE-2023-46239
quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame after the CRYTPO that allows a node to complete the handshake, a remote node could trigger a nil pointer dereference (leading to a panic) when the node attempted to drop the Handshake packet number space. An attacker can bring down a quic-go node with very minimal effort. Completing the QUIC handshake only requires sending and receiving a few packets. Version 0.37.3 contains a patch. Versions before 0.37.0 are not affected.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.008 (53.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 53.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Quic-Go — versions >= 0.37.0, < 0.37.3
- Quic-Go Project
Weakness classification (CWE)
References
- github.com/quic-go/quic-go/security/advisories/GHSA-3q6m-v84f-6p9h (Patch, Vendor Advisory)
- github.com/quic-go/quic-go/commit/b6a4725b60f1fe04e8f1ddcc3114e290fcea1617 (Patch)
- github.com/quic-go/quic-go/releases/tag/v0.37.3 (Release Notes)
Frequently asked questions
- What is CVE-2023-46239?
- CVE-2023-46239 is a high-severity vulnerability in Quic-Go, classified under CWE-248. CVSS score: 7.5/10. Published 2023-10-31.
- How severe is CVE-2023-46239?
- High severity. CVSS v3 base score is 7.5 out of 10.