Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-52811: ngtcp2 may crash or be exploited when qlog is enabled

CVE-2024-52811 · published 1 year ago

Summary

The ngtcp2 library used for the QUIC network protocol can write incorrect data to its logging feature (qlog) and overflow memory. This can cause the application to crash or be taken over if qlog is turned on. Upgrade to version 1.9.1 or keep qlog disabled until you can update.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:Pro:22.04:LTS	canonical	ngtcp2	All versions
Ubuntu:24.04:LTS	canonical	ngtcp2	All versions
Ubuntu:25.10	canonical	ngtcp2	All versions
Ubuntu:26.04:LTS	canonical	ngtcp2	All versions

Original advisory text

Acks not validated before logged to qlog leads to buffer overflow in ngtcp2

The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow. In `ngtcp2_conn::conn_recv_pkt` for an ACK, there was new logic that got added to skip `conn_recv_ack` if an ack has already been processed in the payload. However, this causes us to also skip `ngtcp2_pkt_validate_ack`. The ack which was skipped still got written to qlog. The bug occurs in `ngtcp2_qlog::write_ack_frame`. It is now possible to reach this code with an invalid ack, suppose `largest_ack=0` and `first_ack_range=15`. Subtracting `largest_ack - first_ack_range` will lead to an integer underflow which is 20 chars long. However, the ngtcp2 qlog code assumes the number written is a signed integer and only accounts for 19 characters of overhead (see `NGTCP2_QLOG_ACK_FRAME_RANGE_OVERHEAD`). Therefore, we overwrite the buffer causing a heap overflow. This is high priority and could potentially impact many users if they enable qlog. qlog is disabled by default. Due to its overhead, it is most likely used for debugging purpose, but the actual use is unknown. ngtcp2 v1.9.1 fixes the bug and users are advised to upgrade. Users unable to upgrade should not turn on qlog.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52811... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-52811 Vendor Advisory
https://ubuntu.com/security/CVE-2024-52811 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-52811 Third Party Advisory
https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-4gmv-gf46-r4g5 Vendor Advisory
https://github.com/ngtcp2/ngtcp2/commit/44b662bd139c23fee1703bf256c13349e2e624a1 Patch
https://github.com/ngtcp2/ngtcp2/commit/e550c1a414318d0f3f01fca1a621ae0b0428ca15 Patch

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.2 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-670Always-Incorrect Control Flow Implementation

Timeline

Published25 Nov 2024

Updated31 Oct 2026

First seen7 Mar 2026

Sources

CVE-2024-52811 · NVD

CVE-2024-52811 · OSV

GHSA-4gmv-gf46-r4g5 · GHSA

UBUNTU-CVE-2024-52811 · OSV

Track software like this

Free during beta