CVE-2022-30592
Published: 11 May 2022
Summary
CVE-2022-30592 is a critical-severity NULL Pointer Dereference (CWE-476) vulnerability in Litespeedtech Lsquic. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-30592 is a NULL pointer dereference vulnerability (CWE-476) in the liblsquic/lsquic_qenc_hdl.c file of LiteSpeed QUIC (LSQUIC) versions prior to 3.1.0. The flaw stems from improper handling of the MAX_TABLE_CAPACITY parameter during QUIC connection processing and carries a CVSS 3.1 base score of 9.8 reflecting network-accessible exploitation without authentication or user interaction.
An unauthenticated remote attacker can send a specially crafted QUIC frame that triggers the mishandled capacity value, resulting in a NULL dereference. Successful exploitation can lead to arbitrary code execution or a full compromise of confidentiality, integrity, and availability on the affected server or client.
The referenced GitHub commit and v3.1.0 release tag indicate that the issue is resolved by upgrading to LSQUIC 3.1.0 or later. The EPSS score has remained flat at 0.0839 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-52435
Vulnerability details
liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.