CVE-2020-24606
📋 TL;DR
This vulnerability allows a trusted peer in a Squid proxy cache hierarchy to cause a denial of service by sending a specially crafted Cache Digest response message. The malformed message triggers a livelock condition that consumes all available CPU cycles, rendering the Squid instance unresponsive. Only Squid deployments using cache_peer with the cache digests feature are affected.
💻 Affected Systems
- Squid
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
Squid by Squid Cache
Squid by Squid Cache
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage where Squid becomes unresponsive, consuming 100% CPU and disrupting all proxy services for downstream clients.
Likely Case
Service degradation or complete outage affecting proxy services, potentially disrupting web access for all users behind the proxy.
If Mitigated
Minimal impact if cache digests feature is disabled or if trusted peer relationships are properly secured and monitored.
🎯 Exploit Status
Exploitation requires being a configured trusted peer in the cache hierarchy. The vulnerability is in the cache digest handling code, making exploitation straightforward for authenticated peers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Squid 4.13 or 5.0.4
Vendor Advisory: https://github.com/squid-cache/squid/security/advisories/GHSA-vvj7-xjgq-g2jg
Restart Required: Yes
Instructions:
1. Download and install Squid 4.13 or 5.0.4 from official sources. 2. Apply the patch SQUID-2020_9.patch if upgrading is not possible. 3. Restart the Squid service to apply the fix.
🔧 Temporary Workarounds
Disable Cache Digests
allDisable the cache digests feature if not required for your deployment.
Edit squid.conf and remove or comment out 'cache_peer' lines with 'digest' option
Alternatively, remove 'digest' from existing cache_peer configurations
Restrict Trusted Peers
allLimit cache_peer configurations to only essential, trusted systems and implement network segmentation.
Review and minimize cache_peer entries in squid.conf
Implement firewall rules to restrict access to Squid from cache peers
🧯 If You Can't Patch
- Disable cache digests feature entirely in squid.conf
- Implement strict network segmentation and monitoring for all cache_peer connections
🔍 How to Verify
Check if Vulnerable:
Check squid.conf for cache_peer directives containing 'digest' option and verify Squid version is below 4.13 or 5.0.4.Check Version:
squid -v | grep VersionVerify Fix Applied:
Verify Squid version is 4.13 or higher, or 5.0.4 or higher, and confirm the service is running without CPU spikes from cache digest processing.📡 Detection & Monitoring
Log Indicators:
- High CPU usage alerts
- Process livelock messages in system logs
- Cache digest processing errors in Squid logs
Network Indicators:
- Unusual traffic patterns from cache peers
- Sustained high-volume cache digest exchanges
SIEM Query:
source="squid" AND ("cache_peer" OR "digest") AND (cpu_usage>90 OR "livelock")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html
- http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_9.patch
- https://github.com/squid-cache/squid/security/advisories/GHSA-vvj7-xjgq-g2jg
- https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BE6FKUN7IGTIR2MEEMWYDT7N5EJJLZI2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMTFLVB7GLRF2CKGFPZ4G4R5DIIPHWI3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJJDI7JQFGQLVNCKMVY64LAFMKERAOK7/
- https://security.netapp.com/advisory/ntap-20210219-0007/
- https://security.netapp.com/advisory/ntap-20210226-0006/
- https://security.netapp.com/advisory/ntap-20210226-0007/
- https://usn.ubuntu.com/4477-1/
- https://usn.ubuntu.com/4551-1/
- https://www.debian.org/security/2020/dsa-4751
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html
- http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_9.patch
- https://github.com/squid-cache/squid/security/advisories/GHSA-vvj7-xjgq-g2jg
- https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BE6FKUN7IGTIR2MEEMWYDT7N5EJJLZI2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMTFLVB7GLRF2CKGFPZ4G4R5DIIPHWI3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJJDI7JQFGQLVNCKMVY64LAFMKERAOK7/
- https://security.netapp.com/advisory/ntap-20210219-0007/
- https://security.netapp.com/advisory/ntap-20210226-0006/
- https://security.netapp.com/advisory/ntap-20210226-0007/
- https://usn.ubuntu.com/4477-1/
- https://usn.ubuntu.com/4551-1/
- https://www.debian.org/security/2020/dsa-4751
