CVE-2024-22588: 
Java vulnerability analysis and mitigation

A vulnerability was discovered in Kwik (commit 745fd4e2) where the implementation does not discard unused encryption keys. The vulnerability was identified in January 2024 and affects client-server QUIC connections. This issue is tracked as CVE-2024-22588 (MITRE CVE, NVD).

The vulnerability stems from the retention of unused Initial encryption keys in the Kwik implementation. According to the QUIC protocol specification, Initial keys should be discarded once QUIC has moved to the Handshake encryption level. The vulnerability exists because the implementation fails to follow the key discarding requirements outlined in RFC 9001 (RFC 9001). The CVSS v3.1 base score is 6.5 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L (NVD).

The vulnerability allows attackers to disrupt QUIC connections through a denial of service (DoS) attack. By retaining Initial encryption keys beyond their intended lifecycle, an attacker who can sniff network traffic can send malicious CONNECTION_CLOSE frames encrypted with the captured Initial key, causing connection disruption (QUIC Tester).

Exploitation requires the attacker to have network traffic sniffing capabilities. The attack can be executed by: 1) Capturing the first QUIC packets sent by a client, 2) Computing the Initial encryption key, and 3) Sending a CONNECTION_CLOSE frame to the server in an initial packet encrypted using the computed initial encryption key. The vulnerability has been confirmed exploitable in laboratory conditions (QUIC Tester).

The vulnerability has been fixed in commit 040b0d1327bfb0a8e35c23c2bd612a4a39b721d4. Users should update to the latest version of Kwik that includes this fix. The proper implementation should discard Initial keys once the connection moves to the Handshake encryption level, as specified in the QUIC protocol (Kwik Issue).