Cyber Resilience

CVE-2021-24029

High

Published: 15 March 2021

Published
15 March 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0047 65.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-24029 is a high-severity Reachable Assertion (CWE-617) vulnerability in Facebook Mvfst. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 35.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This…

more

issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.

CWE(s)
CWE-617

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

facebook
mvfst
≤ 2021-03-13
facebook
proxygen
≤ 2021.03.15.00

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References