CyberSecBulletin
CVE-2022-0618NVD status: Modified

SwiftNIO HTTP2: Improper Handling of Length Parameter Inconsistency

Published Updated By the CyberSecBulletin desk

CVE-2022-0618 is a high-severity improper handling of length parameter inconsistency vulnerability in SwiftNIO HTTP2 from Swift Project, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected SwiftNIO HTTP2 versions: 1.0.0; 1.19.2 and earlier. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 1.3% chance of exploitation within 30 days, higher than 71% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Swiftnio Http/2 to 1.20.0 or a later version.
  2. Read the advisory on github.com for workarounds and exact fixed builds.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Swift ProjectSwiftNIO HTTP21.0.0; 1.19.2 and earlierNot stated
AppleSwiftnio Http/21.0.0 up to, but not including, 1.20.01.20.0

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.5HighNVD
CVSS 2.07.8HighNVD

Official description

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSH_PROMISE frame where the frame contains padding information without any other data. This logical error caused confusion about the size of the frame, leading to a parsing error. This parsing error immediately crashes the entire process. Sending a HEADERS frame or PUSH_PROMISE frame with HTTP/2 padding information does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send an appropriately crafted frame. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send appropriately crafted frames, so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself: swift-nio-http2 is parsing the frame in memory-safe code, so the crash is safe. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Handling of Length Parameter Inconsistency

The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

How developers prevent this class of flaw

  • When processing structured incoming data containing a size field followed by raw data, ensure that you identify and resolve any inconsistencies between the size field and the actual size of the data.
  • Do not let the user control the size of the buffer.
  • Validate that the length of the user-supplied data is consistent with the buffer size.

More Improper Handling of Length Parameter Inconsistency vulnerabilities (CWE-130)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in SwiftNIO HTTP2

All SwiftNIO HTTP2 vulnerabilities

Spotted an error? Tell us.