Researchers from Netflix and Google have discovered eight vulnerabilities in various implementations of the HTTP/2 protocol that allow for denial of service by sending specially crafted streams of network requests. These issues affect most HTTP servers that support HTTP/2 to some extent, leading to exhaustion of available memory for processing or excessive CPU load. Updates addressing these vulnerabilities have already been released in and , but are not yet for Apache httpd and .
The problems arose from complexities introduced into the HTTP/2 protocol related to the use of binary structures, data stream limiting within connections, flow prioritization mechanisms, and ICMP-like control messages operating at the HTTP/2 connection level (e.g., ping, reset, and stream settings operations). Many implementations did not properly limit control message flows, inadequately organized priority queue operations when processing requests, or used suboptimal implementations of flow control algorithms.
Most of the identified attack methods involve sending specific requests to the server that generate a large number of responses. If the client does not read data from the socket and does not close the connection, the response buffer queue on the server side continues to fill up. This behavior creates a load on the network connection queue management system and, depending on the implementation's specifics, can lead to exhaustion of available memory or CPU resources.
Identified vulnerabilities:
- CVE-2019-9511 (Data Dribble) — the attacker requests a large volume of data in multiple streams, manipulating the sliding window size and stream priority, causing the server to queue data in blocks of 1 byte;
- CVE-2019-9512 (Ping Flood) — the attacker continuously floods ping messages over the HTTP/2 connection, initiating the filling of the internal response queue on the other side;
- CVE-2019-9513 (Resource Loop) — the attacker creates several streams of requests and continuously changes stream priorities, causing a mixing of the priority tree;
- CVE-2019-9514 (Reset Flood) — the attacker creates multiple threads
and sends an incorrect request through each thread, causing the server to send RST_STREAM frames, but does not accept them to fill the response queue; - CVE-2019-9515 (Settings Flood) — the attacker sends a stream of empty 'SETTINGS' frames, to which the server must acknowledge receipt of each request;
- CVE-2019-9516 (0-Length Headers Leak) — the attacker sends a stream of headers with zero name and zero value, and the server allocates a memory buffer for each header and does not free it until the session ends;
- CVE-2019-9517 (Internal Data Buffering) — the attacker opens
a sliding HTTP/2 window for the server to send data without restrictions, while keeping the TCP window closed, preventing actual writing of data to the socket. The attacker then sends requests that require a large response; - CVE-2019-9518 (Empty Frames Flood) — the attacker sends a stream of frames of type DATA, HEADERS, CONTINUATION, or PUSH_PROMISE, but with empty payloads and no stream termination flag. The server spends time processing each frame, disproportionate to the bandwidth used by the attacker.
Source: opennet.ru
