CVE-2021-24029: Facebook mvfst, логическа грешка

Описание

Оригинално описание

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.

Засегнати продукти

• Facebook mvfst: a67083ff4b8dcbb7ee2839da6338032030d712b0 преди unspecified; unspecified преди a67083ff4b8dcbb7ee2839da6338032030d712b0
• Facebook proxygen: v2021.03.15.00 преди unspecified; unspecified преди v2021.03.15.00

Вид слабост

• CWE-617 Reachable Assertion

История

Други уязвимости в Facebook mvfst

• 7.5CVE-2026-91096
• 5.3CVE-2026-91095
• 7.3CVE-2026-84895
• 7.5CVE-2026-44909
• 5.3CVE-2025-55181

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-24029
• https://nvd.nist.gov/vuln/detail/CVE-2021-24029
• https://github.com/facebookincubator/mvfst/commit/a67083ff4b8dcbb7ee2839da6338032030d712b0
• https://www.facebook.com/security/advisories/cve-2021-24029