CVE-2021-24029
High
Description
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.
SeverityHigh
CVSS7.5
Exploit probability—
ProductFacebook Mvfst
PublishedMar 15, 2021
First seenMar 15, 2021
Weakness typeCWE-617CWE-617
How to fix
Update
- facebook mvfst2021-03-13 or later
- facebook proxygen2021.03.15.00 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| facebook mvfst | v < 2021-03-13 | 2021-03-13 |
| facebook proxygen | v < 2021.03.15.00 | 2021.03.15.00 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.