A malicious HPACK header block could be sent on any of the HPACK-carrying frames in a HTTP/2 connection (HEADERS and PUSH_PROMISE), at any position. Each of these crashes is triggered instead of an integer overflow. There are a number of implementation errors in the parsing of HPACK-encoded header blocks that allow maliciously crafted HPACK header blocks to cause crashes in processes using swift-nio-http2. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. The issue was found by automated fuzzing by oss-fuzz.Ī program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HPACK-encoded header block. The issue is fixed by rewriting the parsing code to correctly handle the condition. This mitigation is not available to many services. The risk can be mitigated if untrusted peers can be prevented from communicating with the service.
However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The attack does not have any confidentiality or integrity risks in and of itself.
It is straightforward for an attacker to repeatedly send these frames, so attackers require very few resources to achieve a substantial denial of service. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. The attack is low-effort: it takes very little resources to send one of these frames. For servers, anyone they allow to connect to them may launch such an attack. For clients, this means any server to which they connect may launch this attack. Sending an ALTSVC or ORIGIN frame does not require any special permission, so any HTTP/2 connection peer may send such a frame. This was left behind from the original development process and was never removed. However, one code path that encounters them has a deliberate trap instead. ORIGIN and ALTSVC frames are not currently supported by swift-nio-http2, and should be ignored. This vulnerability is caused by a logical error after frame parsing but before frame handling. A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames.
0 kommentar(er)
