CVE-2021-24029
📋 TL;DR
This CVE describes a denial-of-service vulnerability in mvfst and proxygen QUIC implementations where a specially crafted QUIC message triggers a failed assertion, causing a crash. Attackers can disrupt QUIC sessions by sending malformed packets that should be treated as connection errors. This affects systems running vulnerable versions of mvfst or proxygen that handle QUIC traffic.
💻 Affected Systems
- mvfst
- proxygen
📦 What is this software?
Mvfst by Facebook
Proxygen by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through denial-of-service, potentially affecting all QUIC sessions handled by vulnerable systems.
Likely Case
Service crashes and temporary unavailability of QUIC-based services until systems restart.
If Mitigated
No impact if patched versions are deployed or if QUIC traffic is filtered/blocked.
🎯 Exploit Status
Exploitation requires ability to send QUIC packets to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: mvfst: commit a67083ff4b8dcbb7ee2839da6338032030d712b0 or later; proxygen: v2021.03.15.00 or later
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2021-24029
Restart Required: Yes
Instructions:
1. Update mvfst to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 or later. 2. Update proxygen to v2021.03.15.00 or later. 3. Rebuild and redeploy applications using these libraries. 4. Restart affected services.
🔧 Temporary Workarounds
QUIC Traffic Filtering
linuxBlock or filter QUIC traffic at network boundaries if QUIC functionality is not required.
# Example iptables rule to block QUIC (UDP 443)
iptables -A INPUT -p udp --dport 443 -j DROP
Rate Limiting
allImplement rate limiting on QUIC connections to reduce impact of potential DoS attacks.
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems from untrusted networks.
- Deploy intrusion prevention systems (IPS) with rules to detect and block malformed QUIC packets.
🔍 How to Verify
Check if Vulnerable:
Check mvfst commit hash or proxygen version against affected versions. For mvfst: verify commit is earlier than a67083ff4b8dcbb7ee2839da6338032030d712b0. For proxygen: verify version is earlier than v2021.03.15.00.Check Version:
For mvfst: git log --oneline -1. For proxygen: check version in build configuration or application output.Verify Fix Applied:
Confirm mvfst commit is a67083ff4b8dcbb7ee2839da6338032030d712b0 or later, or proxygen version is v2021.03.15.00 or later.📡 Detection & Monitoring
Log Indicators:
- Application crashes or restarts
- Failed assertion errors in logs
- QUIC connection errors
Network Indicators:
- Unusual QUIC packet patterns
- Multiple QUIC connection attempts from single sources
SIEM Query:
Example: 'application_crash AND (mvfst OR proxygen) AND QUIC'🔗 References
- https://github.com/facebookincubator/mvfst/commit/a67083ff4b8dcbb7ee2839da6338032030d712b0
- https://www.facebook.com/security/advisories/cve-2021-24029
- https://github.com/facebookincubator/mvfst/commit/a67083ff4b8dcbb7ee2839da6338032030d712b0
- https://www.facebook.com/security/advisories/cve-2021-24029
