Cloudanix VulnDB

CVE-2024-52811

High · 8.2

CVSS

8.2

EPSS

0.8%

Published

Nov 25, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in certain QUIC networking software can let attackers crash or take over systems when an optional debugging feature is turned on, but that feature is off by default so most users are unaffected.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A heap buffer overflow occurs in ngtcp2_qlog::write_ack_frame when an unvalidated ACK frame containing invalid range values (largest_ack=0, first_ack_range=15) reaches the qlog writer after skipping ngtcp2_pkt_validate_ack in conn_recv_pkt, causing integer underflow and exceeding the assumed 19-character overhead in NGTCP2_QLOG_ACK_FRAME_RANGE_OVERHEAD.

Why it matters to the business

Enables potential remote denial of service or code execution in QUIC implementations that enable qlog for debugging, though the feature is disabled by default and primarily used in non-production scenarios; low EPSS and absence from KEV indicate limited active exploitation risk despite high CVSS.

How an attack unfolds

An attacker crafts a QUIC packet with a malicious ACK frame that triggers the early skip of conn_recv_ack in conn_recv_pkt; the invalid ack is still passed to write_ack_frame, producing an integer underflow that overwrites the heap buffer when qlog is active.

How to fix it

Upgrade ngtcp2 to v1.9.1 or apply commit e550c1a414318d0f3f01fca1a621ae0b0428ca15; for gst-plugins-bad0.10 on Ubuntu 14.04 LTS apply the fixed package version 0.10.23-7.2ubuntu1.2. If unable to upgrade, keep qlog disabled.

How to confirm the fix worked

Confirm ngtcp2 version meets or exceeds 1.9.1, review qlog output for proper ACK range handling, and test with crafted ACK frames containing underflow values while qlog is enabled.

Typical attack path

  1. Send a QUIC packet containing a crafted ACK frame with invalid ack range values
  2. Trigger conn_recv_pkt processing that bypasses ack validation due to duplicate detection logic
  3. Reach ngtcp2_qlog::write_ack_frame with the unvalidated ack
  4. Induce integer underflow during range calculation and overflow the allocated qlog buffer

How to detect it

Inspect application logs for ngtcp2 qlog-related crashes or malformed ACK entries; review process execution involving ngtcp2 with qlog enabled and monitor for unexpected heap allocations during packet reception.

What your security team should do

  • Immediately upgrade ngtcp2 and dependent packages to the listed fixed versions
  • Verify qlog remains disabled in all production deployments
  • Include ngtcp2 in vulnerability scanning and patch management workflows given its use in QUIC stacks

The record

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In `ngtcp2_conn::conn_recv_pkt` for an ACK, there was new logic that got added to skip `conn_recv_ack` if an ack has already been processed in the payload. However, this causes us to also skip `ngtcp2_pkt_validate_ack`. The ack which was skipped still got written to qlog. The bug occurs in `ngtcp2_qlog::write_ack_frame`. It is now possible to reach this code with an invalid ack, suppose `largest_ack=0` and `first_ack_range=15`. Subtracting `largest_ack - first_ack_range` will lead to an integer underflow which is 20 chars long. However, the ngtcp2 qlog code assumes the number written is a signed integer and only accounts for 19 characters of overhead (see `NGTCP2_QLOG_ACK_FRAME_RANGE_OVERHEAD`). Therefore, we overwrite the buffer causing a heap overflow. This is high priority and could potentially impact many users if they enable qlog. qlog is disabled by default. Due to its overhead, it is most likely used for debugging purpose, but the actual use is unknown. ngtcp2 v1.9.1 fixes the bug and users are advised to upgrade. Users unable to upgrade should not turn on qlog.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:22.04:LTS ngtcp2 0 No fix
Ubuntu:24.04:LTS ngtcp2 0 No fix
Ubuntu:24.10 ngtcp2 0 No fix
Ubuntu:25.04 ngtcp2 0 No fix
Ubuntu:25.10 ngtcp2 0 No fix
openSUSE:Tumbleweed ngtcp2 0 1.10.0-1.1

Related vulnerabilities