Miggo Logo

CVE-2022-29189: Pion/DTLS contains buffer for inbound DTLS fragments with no limit

5.3

CVSS Score
3.1

Basic Information

EPSS Score
0.746%
Published
5/24/2022
Updated
8/29/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/pion/dtlsgo< 2.1.42.1.4
github.com/pion/dtls/v2go< 2.1.42.1.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from uncontrolled buffering of inbound DTLS fragments. The commit a6397ff added critical size checks to fragmentBuffer.push() and introduced fragmentBuffer.size(), indicating this was the vulnerable area. The CWE-120 classification matches unbounded buffer growth in network input handling. The patch specifically modifies the push method to enforce a 2MB limit, confirming this function's role in the vulnerability. The associated test in fragment_buffer_test.go validates the overflow protection, further confirming the function's central role.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t * *u***r t**t w*s us** *or in*oun* n*twork tr***i* *** no upp*r limit. Pion *TLS woul* *u***r *ll n*twork tr***i* *rom t** r*mot* us*r until t** **n*s**k* *ompl*t*s or tim*s out. *n *tt**k*r *oul* *xploit t*is to **us* *x**ssiv* m*mory us*

Reasoning

T** vuln*r**ility st*ms *rom un*ontroll** *u***rin* o* in*oun* *TLS *r**m*nts. T** *ommit ******* ***** *riti**l siz* ****ks to *r**m*nt*u***r.pus*() *n* intro*u*** *r**m*nt*u***r.siz*(), in*i**tin* t*is w*s t** vuln*r**l* *r**. T** *W*-*** *l*ssi*i*