Homepage

Asymmetric Resource Consumption (Amplification) Affecting fastd package, versions *

Severity

 Recommended
low

Based on Debian security rating.

Threat Intelligence

Exploit Maturity
Not Defined
EPSS
0.04% (16th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN11-FASTD-8663282
  • published27 Jan 2025
  • disclosed27 Jan 2025
Report a new vulnerability Found a mistake?

Introduced: 27 Jan 2025

NewCVE-2025-24356  (opens in a new tab)
CWE-405  (opens in a new tab)

How to fix?

There is no fixed version for Debian:11 fastd.

NVD Description

Note: Versions mentioned in the description apply only to the upstream fastd package and not the fastd package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

fastd is a VPN daemon which tunnels IP packets and Ethernet frames over UDP. When receiving a data packet from an unknown IP address/port combination, fastd will assume that one of its connected peers has moved to a new address and initiate a reconnect by sending a handshake packet. This "fast reconnect" avoids having to wait for a session timeout (up to 90s) until a new connection is established. Even a 1-byte UDP packet just containing the fastd packet type header can trigger a much larger handshake packet (150 bytes of UDP payload). Including IPv4 and UDP headers, the resulting amplification factor is roughly 12-13. By sending data packets with a spoofed source address to fastd instances reachable on the internet, this amplification of UDP traffic might be used to facilitate a Distributed Denial of Service attack. This vulnerability is fixed in v23.