Vulnerability-Research

Sending an RFC 9114 §4.1 trailer HEADERS frame to production HTTP/3 infrastructure triggers state machine failures across two independent CDN edge implementations and the quiche client library. Server-side: 60-second goroutine hang (CDN-A) and 12,200ms QPACK decoder stall with 24.9× worker amplification (CDN-B). Client-side: permanent zombie stream leak in quiche driving Network Service memory from 6 MB to 339 MB before OOM. All three share the same root cause: the second HEADERS frame on a request stream reaches a code path with no defined handler. The threat model inversion — server pushing a malformed trailer toward client — transforms a server-side bug class into a drive-by browser memory exhaustion attack.

A malformed trailer HEADERS frame (END_STREAM=0) on a WebTransport CONNECT stream leaves quiche’s stream state machine permanently stuck: trailers_decompressed_=true but fin_received()=false, causing IsDoneReading() to return false forever. The stream is never removed from stream_map_, ShouldKeepConnectionAlive() holds the QUIC connection open, and Edge sends PING keepalives every ~15s indefinitely. A single webpage can open thousands of these zombie connections with no server-side limit, exhausting Network Service memory and crashing the browser. Both MSRC and Chrome VRP declined to track as security issues.

A second HEADERS frame (RFC 9114 §4.1 trailer) on a YouTube ESF request stream causes a ~60-second server-side hang followed by QUIC INTERNAL_ERROR 0x0001, indicating an unhandled exception in ESF’s HTTP/3 state machine. The crash bypasses HTTP-layer rate limiting and WAF controls architecturally — the connection terminates at the transport layer before any HTTP request object is created. Confirmed deterministically across 3/3 runs. Google VRP declined to track as a security issue. Full PoC and cross-vendor evidence included.

The Windows registry key EnableICMPTimestampRep=0 is silently ignored by tcpip.sys — Ipv4pHandleTimestampRequest generates ICMP Type 14 replies unconditionally regardless of the registry value. Ghidra static analysis of tcpip.sys 10.0.26100.8457 reveals a second RFC 792 violation: Receive and Transmit timestamps are written in little-endian byte order while the adjacent IP Timestamp Option handler correctly calls htonl() on the same value. Confirmed via pcap, netstat ICMP counters, and WinDbg kernel breakpoints. CVE-1999-0524 scope analysis and WFP mitigation rule included.

MAX_LFS_FILESIZE only gates the superblock. A poisoned FUSE_GETATTR reply mutates i_size to UINT64_MAX at runtime. The (pos + count - 1) » PAGE_SHIFT arithmetic wraps unsigned, kworker loops become infinite, and vma_merge() degenerates into an arbitrary OOB-write on Maple Tree-backed kernels. Full mm/ subsystem analysis: filemap.c, mmap.c, XArray walk corruption primitives.

struct fuse_req holds inode references without bumping i_count. SIGKILL a stalled reader, trigger drop_caches inode eviction, delay fuse_abort_conn — the freed slab slot gets reallocated as struct cred. The race delivers a refcount double-decrement on whatever credential lands there: full DirtyCred-class LPE primitive. Complete race window analysis, SLUB reallocation timing, and RCU lifetime breakdown.