1881183 - (CVE-2024-3302) [VU#421644] Possible OOM DOS attack via Http2 CONTINUATION frames

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P2)

Description

[Randell Jesup [:jesup] (needinfo me)]

There's no limit on the number of Continuation Header frames we'll append to a header, even past the maximum size. This could be leveraged by an evil server to OOM a client. There may be a few variations; see the linked bug.

Comment 1

[Kershaw Chang [:kershaw]]

I suggest that we could utilize the existing preference (network.http.max_response_header_size, set at 384K) as the maximum limit for the size of received headers in HTTP/2. When reviewing the telemetry probe data, it appears that the value of mAggregatedHeaderSize is smaller than this limit, indicating that the 384K limit should be fine.

Comment 2

[Kershaw Chang [:kershaw]]

Attachment: Bug 1881183 - Migrate network_http_max_response_header_size to static prefs, r=#necko

Comment 3

[Kershaw Chang [:kershaw]]

Attachment: Bug 1881183 - Avoid allocating too much memory when receiving CONTINUATION frame, r=#necko

Depends on D205233

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8569d595f6ef
Migrate network_http_max_response_header_size to static prefs, r=necko-reviewers,valentin
https://hg.mozilla.org/integration/autoland/rev/b46491dc7c5a
Avoid allocating too much memory when receiving CONTINUATION frame, r=necko-reviewers,valentin

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/8569d595f6ef
https://hg.mozilla.org/mozilla-central/rev/b46491dc7c5a

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Does this need backport? It grafts cleanly to all branches.

Comment 7

[Kershaw Chang [:kershaw]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #6)

Does this need backport? It grafts cleanly to all branches.

Thanks for asking.
I think it's fine to let this ride the train, since this is a sec-low issue.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:kershaw, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox125 to wontfix.

For more information, please visit BugBot documentation.

Comment 9

[Daniel Veditz [:dveditz]]

(In reply to Kershaw Chang [:kershaw] from comment #7)

(In reply to Ryan VanderMeulen [:RyanVM] from comment #6)

Does this need backport? It grafts cleanly to all branches.

Thanks for asking.
I think it's fine to let this ride the train, since this is a sec-low issue.

It may be a "safe crash" kind of annoyance, but it's also a potentially high-profile cross-industry that is already getting attention. CERT is bugging everyone for status on whether their company is affected. Not just software companies who write networking code, but generally whether their companies are running any of the known affected software from other vendors. It's going to be on government checklists where companies selling services to the gov't have to attest their software is not vulnerable, and several vendors are selling things based on stable Linux distros with ESR Firefox.

We're treating this as "sec-low" because users can recover and then stay away from the asshole server that's crashing them. This is being treated as "sec-high" or close to it by most companies who need to keep their servers running or they are losing buckets of money and customer good will.

We need to ship this on ESR-115. We might as well ship it in Fx125 so we don't undercut any good messaging we got out of how quickly we were able to respond to the Pwn2Own exploit.

Comment 10

[Daniel Veditz [:dveditz]]

We definitely should not have checked tests in during the embargo period. Catching some heat for that

Comment 11

[Daniel Veditz [:dveditz]]

assigning CVE-2024-3302 to our implementation's instance of this flaw.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Valentin, can you please nominate this for uplift since Kershaw is on PTO?

Comment 13

[Daniel Veditz [:dveditz]]

https://kb.cert.org/vuls/id/421644
https://nowotarski.info/http2-continuation-flood-technical-details/

Comment 14

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1881183 - Migrate network_http_max_response_header_size to static prefs, r=#necko

Original Revision: https://phabricator.services.mozilla.com/D205233

Comment 15

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1881183 - Avoid allocating too much memory when receiving CONTINUATION frame, r=#necko

Original Revision: https://phabricator.services.mozilla.com/D205234

Comment 16

[Phabricator Automation]

esr115 Uplift Approval Request

• User impact if declined: Potential DOS by server
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: -
• Risk associated with taking this patch: low
• Explanation of risk level: The patch is well tested.
• String changes made/needed: none
• Is Android affected?: yes

Comment 17

[Ryan VanderMeulen [:RyanVM]]

We need to uplift this to Beta also.

Comment 18

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1881183 - Migrate network_http_max_response_header_size to static prefs, r=#necko

Original Revision: https://phabricator.services.mozilla.com/D205233

Comment 19

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1881183 - Avoid allocating too much memory when receiving CONTINUATION frame, r=#necko

Original Revision: https://phabricator.services.mozilla.com/D205234

Comment 20

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: Potential DOS by server
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: -
• Risk associated with taking this patch: low
• Explanation of risk level: The patch is well tested.
• String changes made/needed: none
• Is Android affected?: yes

Comment 21

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/fb4f7dd84ad2
https://hg.mozilla.org/releases/mozilla-esr115/rev/97c5754df7dd

Comment 22

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/b1e9d6256d90
https://hg.mozilla.org/releases/mozilla-beta/rev/523bb014d2f5

Comment 23

[Daniel Veditz [:dveditz]]

Attachment: advisory.txt