Project

General

Profile

Actions
Copy link

Security #6892

closed

http2: oom on copying compressed headers

Added by Philippe Antoine 9 months ago. Updated 8 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
8.0.0-beta1
Affected Versions:
Label:
CVE:
2024-32663
Git IDs:

390f09692eb99809c679d3f350c7cc185d163e1a

Severity:
CRITICAL
Disclosure Date:
06/20/2024

Description

Found by oss-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67562

I would rate this critical : can allocate up to 4Gbytes of memory with 128 kbytes of traffic...

We have one bound of 65k for the maximum "dynamic headers table" size, but this can get multiplied by an arbitrary number of bytes representing one compressed header.

Not sure to backport it for 6 as HTTP2 is experimental there

Subtasks 2 (0 open — 2 closed)

Security #6893: http2: oom on copying compressed headers (7.0.x backport)ClosedPhilippe AntoineActions
Security #6972: http2: oom on copying compressed headers (6.0.x backport)ClosedPhilippe AntoineActions

Related issues 1 (0 open — 1 closed)

Related to Suricata - Security #6900: http2: timeout logging headersClosedPhilippe AntoineActions
Actions
Copy link

Also available in: Atom PDF