Impact

nghttp2 library stops reading the incoming data when user facing
public API nghttp2_session_terminate_session or
nghttp2_session_terminate_session2 is called by the application.
They might be called internally by the library when it detects the
situation that is subject to connection error.

Due to the missing internal state validation, the library keeps
reading the rest of the data after one of those APIs is called. Then
receiving a malformed frame that causes FRAME_SIZE_ERROR causes
assertion failure.

nghttp2_session_terminate_session and
nghttp2_session_terminate_session2 are used interchangeably in the
rest of this document.

The detailed execution paths that lead to assertion failure are:

• nghttp2_session_terminate_session is called from
  nghttp2_on_invalid_frame_recv_callback when processing incoming
  ALTSVC (RFC 7838) frame, and then a malformed frame that causes
  FRAME_SIZE_ERROR is received.

• nghttp2_session_terminate_session is called from
  nghttp2_on_frame_recv_callback when processing PRIORITY_UPDATE,
  ALTSVC, or user-defined extension frame, and then a malformed frame
  that causes FRAME_SIZE_ERROR is received.

• nghttp2_session_terminate_session is called from
  nghttp2_on_extension_chunk_recv_callback when processing
  user-defined extension frame, and then a malformed frame that causes
  FRAME_SIZE_ERROR is received.

• nghttp2_session_terminate_session is called from
  nghttp2_unpack_extension_callback when processing user-defined
  extension frame, and then a malformed frame that causes
  FRAME_SIZE_ERROR is received.

• The malformed PRIORITY_UPDATE frame (e.g., stream_id == 0) is
  received, and then a malformed frame that causes FRAME_SIZE_ERROR is
  received.

For PRIORITY_UPDATE and ALTSVC frames, they must be explicitly enabled
via nghttp2_option_set_builtin_recv_extension_type to be affected.

For user-defined extension frames, they must be explicitly enabled via
nghttp2_option_set_user_recv_extension_type to be affected.

For the builds that disable assert macro (e.g, -DNDEBUG), it does
not hit assertion failure, but it might continue reading incoming
data, which itself does not cause any vulnerability as far as we know.
We still strongly encourage to apply the patch for those builds as
well.

The reporter found the cases where ALTSVC is involved. The other
cases have been investigated and discovered by the nghttp2 development
team.

Patches

nghttp2 v1.68.1 adds missing state validation to avoid assertion
failure.

Workarounds

There is no workaround.

References

The 5c7df8f fixes this vulnerability.