libsoup WebSocket Oversized Control Frame Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in libsoup's WebSocket frame parsing. The issue arises because the library does not properly validate the length of control frames, such as PING, PONG, and CLOSE, as required by RFC 6455 §5.5. This section specifies that control frames must have a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this vulnerability by sending an oversized control frame that violates the protocol. Instead of immediately terminating the connection, the parser mishandles the violation, leading to a crash in the internal processing. This flaw causes a remote denial-of-service condition for applications that use libsoup WebSockets.

Impact

Exploitation of this vulnerability causes a crash in the application using libsoup WebSockets, disrupting the service and potentially causing a resource consumption denial-of-service.

Reproduction

The vulnerability can be reproduced by sending a masked PING frame with a 200-byte payload to a WebSocket server that uses libsoup. The server will accept the frame, process it, and then crash after realizing the payload exceeds the allowed limit. This can be done using a Python script that automates the process of crafting and sending the oversized frame.