CVE-2024-1410: 
Rust vulnerability analysis and mitigation

Cloudflare quiche, a QUIC protocol implementation, was discovered to contain a vulnerability related to unbounded storage of connection ID retirement information (CVE-2024-1410). The vulnerability was disclosed on March 12, 2024, affecting versions prior to 0.19.2 and version 0.20.0. This security issue involves the management of QUIC connection Identifiers (IDs) and their retirement process (GitHub Advisory).

The vulnerability stems from the handling of QUIC connection IDs as specified in RFC 9000 Section 5.1. The issue occurs in the connection ID retirement process, where endpoints declare their supported active connection IDs through the active_connection_id_limit transport parameter. When peers create new IDs using NEW_CONNECTION_ID frames, they must maintain counts within the active ID limit through retirement of old IDs. The vulnerability has been assigned a CVSS v3.1 base score of 3.7 (Low) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating network accessibility but high attack complexity (GitHub Advisory).

The vulnerability can lead to excessive resource consumption in affected systems. When exploited, it results in unbounded storage of information related to connection IDs, potentially impacting system availability (GitHub Advisory).

An unauthenticated remote attacker can exploit this vulnerability by sending NEW_CONNECTION_ID frames and manipulating the connection, for example, by restricting the peer's congestion window size. This manipulation causes RETIRE_CONNECTION_ID frames to be sent at a slower rate than they are received, resulting in an unbounded queue of stored connection ID information (GitHub Advisory).

The vulnerability has been patched in quiche versions 0.19.2 and 0.20.1. There are no workarounds available for affected versions, making upgrading to a patched version the only solution (GitHub Advisory).