Microsoft security update for CVE-2024-53259
🔗 CVE IDs covered (1)
📋 Microsoft's advisory
EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-53259. This page also shows what EchelonGraph holds for CVE-2024-53259, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.
🎯 Affected products5
- azl3 coredns 1.11.4-1 on Azure Linux 3.0
- azl3 coredns 1.11.4-6 on Azure Linux 3.0
- cbl2 coredns 1.11.1-15 on CBL Mariner 2.0
- cbl2 coredns 1.11.1-18 on CBL Mariner 2.0
- cbl2 coredns 1.11.1-18 on CBL-Mariner 2.0
✅ Updates Microsoft lists: 2 updates
2 rows: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.
| KB article | Update | Fixed build |
|---|---|---|
| — | Security Update | 1.11.1-15 |
| — | Security Update | 1.11.4-1 |
🧭 EchelonGraph on CVE-2024-53259
- EchelonGraph score
- 6.5 MEDIUM
- CISA KEV
- Not listed
- Fix status
- A fix is available — apply it.
Description from the CVE record (CVE.org), as published by its numbering authority
quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet. By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they're unable to establish a QUIC connection). The attacker needs to at least know the client's IP and port tuple to mount an attack. This vulnerability is fixed in 0.48.2.
Published by GitHub, Inc., the CVE Numbering Authority that assigned CVE-2024-53259, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).