CVE-2024-27983
Published: April 4, 2024Last modified: August 13, 2024
Description
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition. This vulnerability affects all users in all active release lines: 18.x, 20.x and, 21.x
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.2 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity impact | LOW |
| Availability impact | HIGH |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | nodejs | Fixed (18.20.1-r0) |
| Stream | nodejs | Fixed (20.12.1-r0) | |
| Liberica NIK | 23 (JDK 17) | standard (nodejs) | Fixed (23.0.5+1) |
| 23 (JDK 21) | standard (nodejs) | Fixed (23.1.4+1) | |
| 24 (JDK 22) | nodejs | Fixed (24.0.2+1) |
References
- http://www.openwall.com/lists/oss-security/2024/04/03/16
- https://github.com/nodejs/node/commit/0fb816dbcc
- https://github.com/nodejs/node/commit/3bd39fb474
- https://github.com/nodejs/node/commit/ba1ae6d188
- https://hackerone.com/reports/2319584
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JDECX4BYZLMM4S4LALN4DPZ2HUTTPLKE/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YDVFUH7ACZPYB3BS4SVILNOY7NQU73VW/
- https://nodejs.org/en/blog/vulnerability/april-2024-security-releases/#assertion-failed-in-nodehttp2http2sessionhttp2session-leads-to-http2-server-crash-cve-2024-27983---high
- https://security.netapp.com/advisory/ntap-20240510-0002/