CVE-2022-24668
Vulnerability from cvelistv5
Published
2022-02-09 22:05
Modified
2024-08-03 04:20
Severity ?
Summary
A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after frame parsing but before frame handling. ORIGIN and ALTSVC frames are not currently supported by swift-nio-http2, and should be ignored. However, one code path that encounters them has a deliberate trap instead. This was left behind from the original development process and was never removed. Sending an ALTSVC or ORIGIN frame does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send one of these frames. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send these frames, so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself. This is a controlled, intentional crash. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.
References
cve@forums.swift.orghttps://github.com/apple/swift-nio-http2/security/advisories/GHSA-pgfx-g6rc-8cjvThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/apple/swift-nio-http2/security/advisories/GHSA-pgfx-g6rc-8cjvThird Party Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:49.138Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-pgfx-g6rc-8cjv"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SwiftNIO HTTP2",
          "vendor": "Swift Project",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.19.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after frame parsing but before frame handling. ORIGIN and ALTSVC frames are not currently supported by swift-nio-http2, and should be ignored. However, one code path that encounters them has a deliberate trap instead. This was left behind from the original development process and was never removed. Sending an ALTSVC or ORIGIN frame does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send one of these frames. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send these frames, so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself. This is a controlled, intentional crash. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-241",
              "description": "CWE-241: Improper Handling of Unexpected Data Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-09T22:05:18",
        "orgId": "e4a1ddda-f4f5-496e-96c8-82c37d06abd0",
        "shortName": "Swift"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-pgfx-g6rc-8cjv"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@forums.swift.org",
          "ID": "CVE-2022-24668",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SwiftNIO HTTP2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "1.0.0"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "1.19.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Swift Project"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after frame parsing but before frame handling. ORIGIN and ALTSVC frames are not currently supported by swift-nio-http2, and should be ignored. However, one code path that encounters them has a deliberate trap instead. This was left behind from the original development process and was never removed. Sending an ALTSVC or ORIGIN frame does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send one of these frames. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send these frames, so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself. This is a controlled, intentional crash. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-241: Improper Handling of Unexpected Data Type"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-pgfx-g6rc-8cjv",
              "refsource": "MISC",
              "url": "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-pgfx-g6rc-8cjv"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4a1ddda-f4f5-496e-96c8-82c37d06abd0",
    "assignerShortName": "Swift",
    "cveId": "CVE-2022-24668",
    "datePublished": "2022-02-09T22:05:18",
    "dateReserved": "2022-02-07T00:00:00",
    "dateUpdated": "2024-08-03T04:20:49.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apple:swiftnio_http\\\\/2:*:*:*:*:*:swift:*:*\", \"versionStartIncluding\": \"1.0.0\", \"versionEndExcluding\": \"1.19.2\", \"matchCriteriaId\": \"DAF5D763-09A3-4427-82F7-EF049316E6E8\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after frame parsing but before frame handling. ORIGIN and ALTSVC frames are not currently supported by swift-nio-http2, and should be ignored. However, one code path that encounters them has a deliberate trap instead. This was left behind from the original development process and was never removed. Sending an ALTSVC or ORIGIN frame does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send one of these frames. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send these frames, so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself. This is a controlled, intentional crash. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.\"}, {\"lang\": \"es\", \"value\": \"Un programa que usa swift-nio-http2 es vulnerable a un ataque de denegaci\\u00f3n de servicio causado por un compa\\u00f1ero de red que env\\u00eda tramas ALTSVC u ORIGIN. Este ataque afecta a todas las versiones de swift-nio-http2 desde 1.0.0 hasta 1.19.1. Esta vulnerabilidad es causada por un error l\\u00f3gico despu\\u00e9s del an\\u00e1lisis de la trama, pero antes del manejo de la misma. Las tramas ORIGIN y ALTSVC no son soportadas actualmente por swift-nio-http2, y deben ser ignoradas. Sin embargo, una ruta de c\\u00f3digo que es encontrada con ellos presenta una trampa deliberada en su lugar. Esto fue dejado atr\\u00e1s desde el proceso de desarrollo original y nunca fue eliminado. El env\\u00edo de una trama ALTSVC u ORIGIN no requiere ning\\u00fan permiso especial, por lo que cualquier par de conexi\\u00f3n HTTP/2 puede enviar dicha trama. Para los clientes, esto significa que cualquier servidor al que sean conectados puede lanzar este ataque. Para los servidores, cualquier persona a la que permitan conectarse puede lanzar este ataque. El ataque es de bajo esfuerzo: son necesarios muy pocos recursos para enviar una de estas tramas. El impacto en la disponibilidad es elevado: la recepci\\u00f3n de la trama bloquea inmediatamente el servidor, cayendo todas las conexiones en curso y causando la necesidad de reiniciar el servicio. Es sencillo para un atacante enviar repetidamente estas tramas, por lo que los atacantes necesitan muy pocos recursos para lograr una denegaci\\u00f3n de servicio sustancial. El ataque no presenta ning\\u00fan riesgo de confidencialidad o integridad en s\\u00ed mismo. Se trata de un bloqueo controlado e intencionado. Sin embargo, los bloqueos repentinos de procesos pueden conllevar a violaciones de invariantes en los servicios, por lo que es posible que este ataque pueda ser usado para desencadenar una condici\\u00f3n de error que tenga riesgos de confidencialidad o integridad. El riesgo puede mitigarse si puede evitarse que los compa\\u00f1eros que no son confiables sean comunicados con el servicio. Esta mitigaci\\u00f3n no est\\u00e1 disponible para muchos servicios. El problema es corregido al reescribir el c\\u00f3digo de an\\u00e1lisis para manejar correctamente la condici\\u00f3n. El problema se encontr\\u00f3 mediante un fuzzing automatizado con oss-fuzz\"}]",
      "id": "CVE-2022-24668",
      "lastModified": "2024-11-21T06:50:49.670",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:N/I:N/A:P\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2022-02-09T23:15:20.327",
      "references": "[{\"url\": \"https://github.com/apple/swift-nio-http2/security/advisories/GHSA-pgfx-g6rc-8cjv\", \"source\": \"cve@forums.swift.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/apple/swift-nio-http2/security/advisories/GHSA-pgfx-g6rc-8cjv\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@forums.swift.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"cve@forums.swift.org\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-241\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-24668\",\"sourceIdentifier\":\"cve@forums.swift.org\",\"published\":\"2022-02-09T23:15:20.327\",\"lastModified\":\"2024-11-21T06:50:49.670\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after frame parsing but before frame handling. ORIGIN and ALTSVC frames are not currently supported by swift-nio-http2, and should be ignored. However, one code path that encounters them has a deliberate trap instead. This was left behind from the original development process and was never removed. Sending an ALTSVC or ORIGIN frame does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send one of these frames. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send these frames, so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself. This is a controlled, intentional crash. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.\"},{\"lang\":\"es\",\"value\":\"Un programa que usa swift-nio-http2 es vulnerable a un ataque de denegaci\u00f3n de servicio causado por un compa\u00f1ero de red que env\u00eda tramas ALTSVC u ORIGIN. Este ataque afecta a todas las versiones de swift-nio-http2 desde 1.0.0 hasta 1.19.1. Esta vulnerabilidad es causada por un error l\u00f3gico despu\u00e9s del an\u00e1lisis de la trama, pero antes del manejo de la misma. Las tramas ORIGIN y ALTSVC no son soportadas actualmente por swift-nio-http2, y deben ser ignoradas. Sin embargo, una ruta de c\u00f3digo que es encontrada con ellos presenta una trampa deliberada en su lugar. Esto fue dejado atr\u00e1s desde el proceso de desarrollo original y nunca fue eliminado. El env\u00edo de una trama ALTSVC u ORIGIN no requiere ning\u00fan permiso especial, por lo que cualquier par de conexi\u00f3n HTTP/2 puede enviar dicha trama. Para los clientes, esto significa que cualquier servidor al que sean conectados puede lanzar este ataque. Para los servidores, cualquier persona a la que permitan conectarse puede lanzar este ataque. El ataque es de bajo esfuerzo: son necesarios muy pocos recursos para enviar una de estas tramas. El impacto en la disponibilidad es elevado: la recepci\u00f3n de la trama bloquea inmediatamente el servidor, cayendo todas las conexiones en curso y causando la necesidad de reiniciar el servicio. Es sencillo para un atacante enviar repetidamente estas tramas, por lo que los atacantes necesitan muy pocos recursos para lograr una denegaci\u00f3n de servicio sustancial. El ataque no presenta ning\u00fan riesgo de confidencialidad o integridad en s\u00ed mismo. Se trata de un bloqueo controlado e intencionado. Sin embargo, los bloqueos repentinos de procesos pueden conllevar a violaciones de invariantes en los servicios, por lo que es posible que este ataque pueda ser usado para desencadenar una condici\u00f3n de error que tenga riesgos de confidencialidad o integridad. El riesgo puede mitigarse si puede evitarse que los compa\u00f1eros que no son confiables sean comunicados con el servicio. Esta mitigaci\u00f3n no est\u00e1 disponible para muchos servicios. El problema es corregido al reescribir el c\u00f3digo de an\u00e1lisis para manejar correctamente la condici\u00f3n. El problema se encontr\u00f3 mediante un fuzzing automatizado con oss-fuzz\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cve@forums.swift.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-241\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apple:swiftnio_http\\\\/2:*:*:*:*:*:swift:*:*\",\"versionStartIncluding\":\"1.0.0\",\"versionEndExcluding\":\"1.19.2\",\"matchCriteriaId\":\"DAF5D763-09A3-4427-82F7-EF049316E6E8\"}]}]}],\"references\":[{\"url\":\"https://github.com/apple/swift-nio-http2/security/advisories/GHSA-pgfx-g6rc-8cjv\",\"source\":\"cve@forums.swift.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/apple/swift-nio-http2/security/advisories/GHSA-pgfx-g6rc-8cjv\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.