CVE-2024-39920

{"id": "CVE-2024-39920", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-07-03T04:15:04.267", "references": [{"url": "https://github.com/IAIK/SnailLoad", "source": "cve@mitre.org"}, {"url": "https://news.ycombinator.com/item?id=40809629", "source": "cve@mitre.org"}, {"url": "https://twitter.com/tugraz/status/1805272833322299412", "source": "cve@mitre.org"}, {"url": "https://www.instagram.com/p/C8wpO1UtExw/", "source": "cve@mitre.org"}, {"url": "https://www.rfc-editor.org/rfc/rfc9293.txt", "source": "cve@mitre.org"}, {"url": "https://www.snailload.com", "source": "cve@mitre.org"}, {"url": "https://www.snailload.com/snailload.pdf", "source": "cve@mitre.org"}, {"url": "https://www.tugraz.at/en/tu-graz/services/news-stories/tu-graz-news/singleview/article/neue-sicherheitsluecke-erlaubt-ueberwachung-besuchter-websites-und-angesehener-videos", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-1255"}]}], "descriptions": [{"lang": "en", "value": "The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server), when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the \"SnailLoad\" issue. For example, the attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number."}, {"lang": "es", "value": "El protocolo TCP en RFC 9293 tiene un canal lateral de temporizaci\u00f3n que facilita a atacantes remotos inferir el contenido de una conexi\u00f3n TCP desde un sistema cliente (a cualquier servidor), cuando ese sistema cliente est\u00e1 obteniendo simult\u00e1neamente datos TCP a una velocidad lenta desde un servidor controlado por un atacante, tambi\u00e9n conocido como el problema \"SnailLoad\". Por ejemplo, el ataque puede comenzar midiendo los RTT a trav\u00e9s de los segmentos TCP cuya funci\u00f3n es proporcionar un bit de control ACK y un n\u00famero de reconocimiento."}], "lastModified": "2024-08-05T19:35:13.550", "sourceIdentifier": "cve@mitre.org"}