Issue summary: A malicious remote peer may flood the local QUIC stack with NEW CONNECTION ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use.

Impact summary: The local QUIC stack sends a RETIRE CONN ID frame for every NEW CONNECTION ID frame it receives. The RETIRE CONN ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can force the local stack to allocate ~400MB (depending on ACK delay).

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID) the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence number. The sequence number is transmitted in NEW CONNECTION ID and RETIRE CONNECTION ID frames to identify the CID which is being either associated with a connection or retired.

The remote peer sends a NEW CONNECTION ID frame to let the local stack know a new CID is being associated with an existing connection. The NEW CONNECTION ID frame carries the new CID, its sequence number, and the retire-prior-to number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must send a RETIRE CONNECTION ID for every destination CID whose sequence number is less than retire-prior-to. The CID becomes retired after the local stack receives an ACK for its RETIRE CONNECTION ID frame.

Although the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into processing more than one RETIRE CONNECTION ID frame per connection. The OpenSSL QUIC stack currently retires the destination CID as soon as it receives the NEW CONNECTION ID, while in fact the destination CID must be retired after an ACK for the RETIRE CONNECTION ID frame is received. Correcting the flawed logic also fixes the backlog growth.

[1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids

FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.