CVE-2024-22590

The TLS engine in Kwik does not implement a mechanism for tracking the current connection state (CWE-372 — incomplete state machine implementation). The lack of this control causes the Client Hello message — normally sent only at the beginning of negotiation (handshake) — to be overwritten by an attacker at any point in the connection's lifetime, even after it has been fully established. An unauthenticated remote attacker can send a crafted Client Hello message to an already active session and cause its disruption or take control of the TLS negotiation process.

An attacker can disrupt or destroy the integrity of active TLS connections and cause their unavailability (violation of integrity and availability). The attack does not require authentication or user interaction and is possible remotely over the network.

Apply patches available from the vendor according to the references. It is recommended to update the Kwik library to a version after commit 745fd4e2, in which TLS state machine handling was fixed. Until the patch is applied, consider restricting network access to services using the vulnerable version of the library.

Kwik library in the version corresponding to commit 745fd4e2; the exact version range is indicated in the vendor's references.