CVE-2024-22590
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-22590 is a critical-severity Incomplete Internal State Distinction (CWE-372) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-24 (Fail in Known State) and AC-12 (Session Termination) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-20124
Vulnerability Data
The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. This vulnerability can allow Client Hello messages to be overwritten at any time, including after a connection has been established.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Ensures the system enters a predefined safe state on failure, containing damage from any prior state-distinction error.
Forces sessions into a known terminated state, limiting the window in which an incorrect state assumption can be exploited.
Enforces access decisions that depend on correctly maintained internal state, making incorrect operations due to state confusion less likely to succeed.
Requires developers to produce security architecture and design artifacts that must address correct internal state management.
Mandates application of engineering principles (e.g., explicit state-machine design, fail-safe defaults) that stop incomplete state distinction from being introduced.
Requires protection of session state authenticity, directly reducing the chance that the system misidentifies its own session state.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle practices can include state-machine validation and invariant checks that reduce incomplete internal state errors.
A.8.26 only requires that security requirements (including resilience against attacks such as SQL injection) be identified and specified during development or acquisition; it does not itself enforce, implement, or prevent the incomplete state distinction from arising or being exploitable.
A.8.27 mandates security-by-design principles (defense-in-depth, least privilege, fail securely, distrust external input, assume-breach, zero-trust verification) plus design reviews that can catch and block many incomplete-state assumptions before they reach code, but leaves a bounded remainder: state-machine logic errors that are not visible in architecture, do not violate any listed principle, and are introduced in detailed implementation rather than high-level design.
Secure coding standards can require defensive checks against invalid or ambiguous internal states.
Security testing can detect state-machine flaws that manifest as incomplete internal state distinction.