CVE-2025-24946

Executive Summary

CVE-2025-24946 is a vulnerability in the Picoquic library, a QUIC protocol implementation. The core issue is a weak hash function used in the hash table that manages connections. An unauthenticated, remote attacker can exploit this by sending a series of connections with colliding Source Connection IDs (SCIDs). This forces the server to perform an excessive number of hash collisions, leading to a significant CPU load and effectively a Denial of Service (Hash DoS) attack. The vulnerability has a CVSS score of 5.3 (Medium) and is patched in commit b80fd3f. No public exploit code or PoC is currently available.

Supply Chain & Package Security

Picoquic is a C library used for implementing the QUIC protocol. It is not distributed through common package managers like NPM, PyPI, Go, or Ruby. The risk is primarily for applications that directly integrate this library as a dependency. Organizations using Picoquic should verify their version and apply the patch immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Network (N) - The attack can be launched remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): None (N) - No data is modified.
• Availability (A): Low (L) - The attack can cause a performance degradation (CPU exhaustion), leading to a partial denial of service.

Threat Level: Medium. While the impact is limited to availability, the attack is easy to execute remotely without authentication. The lack of a public PoC currently reduces the immediate threat, but the vulnerability is trivial to exploit once understood.

Deep Dive & Mechanics

The vulnerability lies in the hash table used by Picoquic to manage active QUIC connections. Each connection is identified by a Source Connection ID (SCID). When a new connection is initiated, the server hashes the SCID to determine its bucket in the hash table.

The weakness is that the hash function used is not cryptographically strong and is predictable. An attacker can craft a series of SCIDs that all hash to the same bucket. When the server processes these connections, it will attempt to insert them into the same bucket, causing a chain of collisions. For each collision, the server must traverse the linked list in the bucket to check for duplicates, leading to O(n) lookup time instead of O(1). By sending a large number of colliding SCIDs, the attacker can force the server to spend an excessive amount of CPU time on hash table operations, effectively starving other processes and causing a denial of service.

The attack is a classic Hash DoS (also known as Hash Collision DoS), similar to attacks on hash tables in other protocols (e.g., HTTP POST parameters). The fix involves replacing the weak hash function with a cryptographically secure, randomized hash (e.g., SipHash) that is resistant to collision attacks.

Vulnerable vs. Patched Code

The vulnerable code is in the hash table implementation within Picoquic. The exact function is likely picoquic_hash_add or similar, which uses a weak hash like a simple modulo or a non-cryptographic hash (e.g., DJB2, FNV-1a).

Vulnerable Code (Conceptual):

// Weak hash function - predictable
uint32_t weak_hash(uint8_t *scid, size_t len) {
    uint32_t hash = 0;
    for (size_t i = 0; i < len; i++) {
        hash = hash * 31 + scid[i];
    }
    return hash % TABLE_SIZE;
}

int picoquic_hash_add(picoquic_hashtable_t *table, uint8_t *scid, size_t len, void *value) {
    uint32_t bucket = weak_hash(scid, len);
    // ... insert into bucket, causing collisions
}

Patched Code (Conceptual):

// Strong, randomized hash function (e.g., SipHash)
uint32_t strong_hash(uint8_t *scid, size_t len, uint64_t key) {
    // Use a cryptographic hash like SipHash-2-4
    return siphash(scid, len, key) % TABLE_SIZE;
}

int picoquic_hash_add(picoquic_hashtable_t *table, uint8_t *scid, size_t len, void *value) {
    uint32_t bucket = strong_hash(scid, len, table->secret_key);
    // ... insert into bucket, collisions are now random
}

The patch in commit b80fd3f replaces the weak hash with a strong, keyed hash function (likely SipHash). The key is generated randomly at server startup, making it impossible for an attacker to predict the hash output.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Objective: Cause CPU exhaustion on a Picoquic server by sending connections with colliding SCIDs.

Prerequisites:

• A target running a vulnerable version of Picoquic (before commit b80fd3f).
• Ability to send arbitrary QUIC Initial packets.

Attack Steps:

1. Analyze the Hash Function: Reverse engineer the vulnerable Picoquic binary to determine the exact weak hash algorithm used.
2. Generate Colliding SCIDs: Write a script to generate a set of SCIDs that all produce the same hash value. For example, if the hash is a simple sum, generate SCIDs with the same sum.
3. Launch the Attack: Send a large number of QUIC Initial packets, each with a different colliding SCID, to the target server. Tools like scapy or a custom QUIC client can be used.

Example Python Script (Conceptual):

import socket
import struct

# Assume we know the weak hash is a simple XOR of bytes
def weak_hash(scid):
    h = 0
    for b in scid:
        h ^= b
    return h

# Generate colliding SCIDs (all have the same XOR result)
target_hash = 0x42
colliding_scids = []
for i in range(1000):
    # Craft SCID that XORs to target_hash
    scid = bytes([0x00] * 7 + [target_hash ^ (i & 0xFF)])
    colliding_scids.append(scid)

# Send QUIC Initial packets with these SCIDs
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
for scid in colliding_scids:
    # Build a minimal QUIC Initial packet (simplified)
    packet = build_quic_initial_packet(scid)
    sock.sendto(packet, ("target_ip", 443))

Expected Outcome: The server's CPU usage spikes to near 100%, causing legitimate connections to time out or be dropped.

Blue Team (Defense & Detection)

Defensive Measures:

1. Patch Immediately: Update Picoquic to the latest version that includes commit b80fd3f.
2. Rate Limiting: Implement rate limiting on new connection requests from a single source IP. This can mitigate the impact of a large-scale attack.
3. Anomaly Detection: Monitor for a high number of new connection attempts with unique SCIDs from a single source.
4. Resource Monitoring: Set up alerts for unusual CPU spikes on servers running Picoquic.

Detection Strategy:

• Monitor network traffic for a high volume of QUIC Initial packets with varying SCIDs from a single source.
• Analyze server logs for a sudden increase in hash table collisions (if such metrics are exposed).
• Use the Sigma rule below to detect the attack pattern.

Indicators of Compromise (IOCs)

• Network IOCs:
  • High volume of UDP packets to port 443 (or other QUIC ports) from a single source IP.
  • Packets contain QUIC Initial headers with varying Source Connection IDs.
  • The SCIDs may exhibit a pattern (e.g., all have the same byte-wise XOR or sum).
• System IOCs:
  • Unusually high CPU usage on the server process handling QUIC connections.
  • Server logs showing a large number of connection timeouts or failed handshakes.
  • Memory pressure due to hash table growth.

Detection Engineering

YARA Rule

rule CVE_2025_24946_Hash_DoS_SCID_Collision {
    meta:
        description = "Detects network traffic patterns indicative of CVE-2025-24946 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24946"
    strings:
        // Look for QUIC Initial packets (first byte 0xC0 for long header)
        $quic_initial = { c0 }
        // SCID length field (typically 0x08 for 8-byte SCID)
        $scid_len = { 08 }
    condition:
        // Check for multiple packets with different SCIDs from same source
        // This is a simplified rule; in practice, use a tool like Zeek or Suricata
        #quic_initial > 100 and #scid_len > 100
}

Sigma Rule

title: CVE-2025-24946 Picoquic Hash DoS Attack
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects a high volume of QUIC Initial packets with unique SCIDs from a single source, indicating a Hash DoS attack.
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24946
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        proto: udp
        service: quic
        # Zeek field for SCID
        scid|unique_count: > 100
        id.orig_h|count: 1
    condition: selection
falsepositives:
    - Legitimate high-traffic QUIC servers
level: medium
tags:
    - attack.t1498
    - cve.2025.24946

Suricata Rule

alert udp any any -> any 443 (msg:"CVE-2025-24946 Picoquic Hash DoS Attempt"; flow:to_server; content:"|c0|"; depth:1; content:"|08|"; distance:0; within:1; threshold:type both, track by_src, count 100, seconds 60; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update Picoquic to the latest version that includes commit b80fd3f. This replaces the weak hash function with a cryptographically secure one.
2. Workaround (if patching is not possible):
   • Implement rate limiting on new QUIC connections per source IP.
   • Deploy a Web Application Firewall (WAF) or load balancer that can inspect and rate-limit QUIC traffic.
   • Monitor server CPU and memory usage and set up alerts for anomalies.
3. Long-Term Prevention:
   • Always use cryptographically secure, randomized hash functions for hash tables that handle untrusted input.
   • Follow secure coding practices for network-facing components.
   • Regularly update dependencies and monitor for security advisories.

Valters IT - Securing your digital infrastructure with elite DevSecOps and Cyber Threat Intelligence.