Quicly Connection State Corruption Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Quicly, an IETF QUIC protocol implementation primarily for the H2O HTTP server. The issue arises from connection state corruption due to improper handling of Connection IDs in QUIC version 1. While Quicly's CID buffers are limited to 20 bytes, the packet decoder accepts Connection IDs of up to 255 bytes to respond to unknown QUIC versions. This discrepancy allows QUIC v1 packets with oversized CIDs to be processed, leading to buffer overruns and assertion failures. The vulnerability exists in Quicly commits prior to 8b178e6.

Impact

Exploitation of this vulnerability causes assertion failures due to connection state corruption, although the buffer overflow is contained within the allocated memory.

Reproduction

The vulnerability can be reproduced by sending a QUIC version 1 packet with a Connection ID longer than 20 bytes to a Quicly implementation that does not enforce CID length restrictions. This can be done using the Quicly command line tool or by modifying an application that uses the Quicly library to omit CID length checks.

Remediation

Users can update to Quicly version 8b178e6 or later, where this vulnerability has been fixed.