1. Home
  2. CVE Database
  3. CVE-2021-24029
HIGH · 7.5

CVE-2021-24029

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message shou...

Vulnerability Description

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
FacebookMvfst< 2021-03-13
FacebookProxygen< 2021.03.15.00

Related Weaknesses (CWE)

CWE-617

References

FAQ

What is CVE-2021-24029?

CVE-2021-24029 is a vulnerability with a CVSS score of 7.5 (HIGH). A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message shou...

How severe is CVE-2021-24029?

CVE-2021-24029 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-24029?

Check the references section above for vendor advisories and patch information. Affected products include: Facebook Mvfst, Facebook Proxygen.