AIKIDO-2024-10504

TL;DR

Affected versions of quic-go are vulnerable to a disruption attack where an off-path attacker can inject a forged ICMP "Packet Too Large" message. Because quic-go uses IP_PMTUDISC_DO, the kernel returns a "message too large" error when attempting to send packets exceeding the spoofed MTU. By setting the MTU below the QUIC minimum of 1200 bytes, the attacker can disrupt the connection even after the handshake, bypassing fallback mechanisms like HTTP over TCP. The attack requires the attacker to know both the client’s and server’s IP and port information.