CVE-2024-27983

EUVD-2024-25157

09.04.2024, 01:15

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

Race Condition

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.2 HIGH	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 99%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
nodejs	nodejs	𝑥 ≤ 18.20.0	ADP
nodejs	nodejs	𝑥 ≤ 20.12.0	ADP
nodejs	nodejs	𝑥 ≤ 21.7.1	ADP

Debian Releases

Debian Product

Codename

nodejs

bookworm	18.20.4+dfsg-1~deb12u1 fixed
bookworm (security)	18.20.4+dfsg-1~deb12u1 fixed
bullseye	vulnerable
bullseye (security)	12.22.12~dfsg-1~deb11u7 fixed
forky	22.21.1+dfsg+~cs22.19.0-6 fixed
sid	22.21.1+dfsg+~cs22.19.0-6 fixed
trixie	20.19.2+dfsg-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

nodejs

bionic	not-affected
focal	needed
jammy	needed
mantic	ignored
noble	needed
oracular	not-affected
plucky	not-affected
questing	not-affected
trusty	not-affected
xenial	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

nodejs12

suse enterprise server 15 SP2	12.22.12-150200.4.59.1 fixed
suse enterprise server 15 SP3	12.22.12-150200.4.59.1 fixed

nodejs12-devel

suse enterprise server 15 SP2	12.22.12-150200.4.59.1 fixed
suse enterprise server 15 SP3	12.22.12-150200.4.59.1 fixed

nodejs12-docs

suse enterprise server 15 SP2	12.22.12-150200.4.59.1 fixed
suse enterprise server 15 SP3	12.22.12-150200.4.59.1 fixed

nodejs14

suse enterprise server 15 SP2	14.21.3-150200.15.58.1 fixed
suse enterprise server 15 SP3	14.21.3-150200.15.58.1 fixed

nodejs14-devel

suse enterprise server 15 SP2	14.21.3-150200.15.58.1 fixed
suse enterprise server 15 SP3	14.21.3-150200.15.58.1 fixed

nodejs14-docs

suse enterprise server 15 SP2	14.21.3-150200.15.58.1 fixed
suse enterprise server 15 SP3	14.21.3-150200.15.58.1 fixed

nodejs16

suse enterprise server 15 SP3	16.20.2-150300.7.36.2 fixed
suse enterprise server 15 SP4	16.20.2-150400.3.33.1 fixed

nodejs16-devel

suse enterprise server 15 SP3	16.20.2-150300.7.36.2 fixed
suse enterprise server 15 SP4	16.20.2-150400.3.33.1 fixed

nodejs16-docs

suse enterprise server 15 SP3	16.20.2-150300.7.36.2 fixed
suse enterprise server 15 SP4	16.20.2-150400.3.33.1 fixed

nodejs18

suse enterprise sap 15 SP5	18.20.1-150400.9.21.3 fixed
suse enterprise server 15 SP4	18.20.1-150400.9.21.3 fixed
suse enterprise server 15 SP5	18.20.1-150400.9.21.3 fixed

nodejs18-devel

suse enterprise sap 15 SP5	18.20.1-150400.9.21.3 fixed
suse enterprise server 15 SP4	18.20.1-150400.9.21.3 fixed
suse enterprise server 15 SP5	18.20.1-150400.9.21.3 fixed

nodejs18-docs

suse enterprise sap 15 SP5	18.20.1-150400.9.21.3 fixed
suse enterprise server 15 SP4	18.20.1-150400.9.21.3 fixed
suse enterprise server 15 SP5	18.20.1-150400.9.21.3 fixed

nodejs20

suse enterprise sap 15 SP5	20.12.1-150500.11.9.2 fixed
suse enterprise server 15 SP5	20.12.1-150500.11.9.2 fixed

nodejs20-devel

suse enterprise sap 15 SP5	20.12.1-150500.11.9.2 fixed
suse enterprise server 15 SP5	20.12.1-150500.11.9.2 fixed

nodejs20-docs

suse enterprise sap 15 SP5	20.12.1-150500.11.9.2 fixed
suse enterprise server 15 SP5	20.12.1-150500.11.9.2 fixed

npm12

suse enterprise server 15 SP2	12.22.12-150200.4.59.1 fixed
suse enterprise server 15 SP3	12.22.12-150200.4.59.1 fixed

npm14

suse enterprise server 15 SP2	14.21.3-150200.15.58.1 fixed
suse enterprise server 15 SP3	14.21.3-150200.15.58.1 fixed

npm16

suse enterprise server 15 SP3	16.20.2-150300.7.36.2 fixed
suse enterprise server 15 SP4	16.20.2-150400.3.33.1 fixed

npm18

suse enterprise sap 15 SP5	18.20.1-150400.9.21.3 fixed
suse enterprise server 15 SP4	18.20.1-150400.9.21.3 fixed
suse enterprise server 15 SP5	18.20.1-150400.9.21.3 fixed

npm20

suse enterprise sap 15 SP5	20.12.1-150500.11.9.2 fixed
suse enterprise server 15 SP5	20.12.1-150500.11.9.2 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

nodejs

RHEL 9

1:16.20.2-8.el9_4

fixed

nodejs-docs

RHEL 9

1:16.20.2-8.el9_4

fixed

nodejs-full-i18n

RHEL 9

1:16.20.2-8.el9_4

fixed

nodejs-libs

RHEL 9

1:16.20.2-8.el9_4

fixed

npm

RHEL 9

1:8.19.4-1.16.20.2.8.el9_4

fixed

Amazon Linux Releases

Amazon Package

Release

nodejs

Amazon Linux 2023

1:18.18.2-1.amzn2023.0.4

fixed

nodejs-debuginfo

Amazon Linux 2023

1:18.18.2-1.amzn2023.0.4

fixed

nodejs-debugsource

Amazon Linux 2023

1:18.18.2-1.amzn2023.0.4

fixed

nodejs-devel

Amazon Linux 2023

1:18.18.2-1.amzn2023.0.4

fixed

nodejs-docs

Amazon Linux 2023

1:18.18.2-1.amzn2023.0.4

fixed

nodejs-full-i18n

Amazon Linux 2023

1:18.18.2-1.amzn2023.0.4

fixed

nodejs-libs

Amazon Linux 2023

1:18.18.2-1.amzn2023.0.4

fixed

nodejs-libs-debuginfo

Amazon Linux 2023

1:18.18.2-1.amzn2023.0.4

fixed

nodejs-npm

Amazon Linux 2023

1:9.8.1-1.18.18.2.1.amzn2023.0.4

fixed

nodejs20

Amazon Linux 2023

1:20.12.2-1.amzn2023.0.2

fixed

nodejs20-debuginfo

Amazon Linux 2023

1:20.12.2-1.amzn2023.0.2

fixed

nodejs20-debugsource

Amazon Linux 2023

1:20.12.2-1.amzn2023.0.2

fixed

nodejs20-devel

Amazon Linux 2023

1:20.12.2-1.amzn2023.0.2

fixed

nodejs20-docs

Amazon Linux 2023

1:20.12.2-1.amzn2023.0.2

fixed

nodejs20-full-i18n

Amazon Linux 2023

1:20.12.2-1.amzn2023.0.2

fixed

nodejs20-libs

Amazon Linux 2023

1:20.12.2-1.amzn2023.0.2

fixed

nodejs20-libs-debuginfo

Amazon Linux 2023

1:20.12.2-1.amzn2023.0.2

fixed

nodejs20-npm

Amazon Linux 2023

1:10.5.0-1.20.12.2.1.amzn2023.0.2

fixed

v8-10.2-devel

Amazon Linux 2023

3:10.2.154.26-1.18.18.2.1.amzn2023.0.4

fixed

v8-11.3-devel

Amazon Linux 2023

3:11.3.244.8-1.20.12.2.1.amzn2023.0.2

fixed

Azure Linux Releases

Azure Package

Release

nodejs

Azure Linux 3.0

0:20.14.0-1.azl3

fixed

nodejs18

CBL-Mariner 2.0

0:18.18.2-7.cm2

fixed

Common Weakness Enumeration

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References

http://www.openwall.com/lists/oss-security/2024/04/03/16

https://hackerone.com/reports/2319584

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDECX4BYZLMM4S4LALN4DPZ2HUTTPLKE/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YDVFUH7ACZPYB3BS4SVILNOY7NQU73VW/

https://security.netapp.com/advisory/ntap-20240510-0002/

http://www.openwall.com/lists/oss-security/2024/04/03/16

https://hackerone.com/reports/2319584

https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDECX4BYZLMM4S4LALN4DPZ2HUTTPLKE/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YDVFUH7ACZPYB3BS4SVILNOY7NQU73VW/

https://security.netapp.com/advisory/ntap-20240510-0002/

https://www.kb.cert.org/vuls/id/421644