^{CVE-2020-13934:}Apache Tomcat HTTP/2 Upgrade Memory Leak Vulnerability

Overview

This vulnerability (CVE-2020-13934) affects the HTTP/2 protocol implementation in Apache Tomcat. The issue occurs specifically during h2c protocol upgrades, where the application fails to properly release HTTP/1.1 processor resources after upgrading the connection to HTTP/2. Each upgrade request that isn't properly handled causes memory resources to be retained unnecessarily. Over time, as these unreleased resources accumulate, the server can experience memory exhaustion, resulting in an OutOfMemoryException and denial of service.

The vulnerability combines two Common Weakness Enumeration (CWE) types:

1. CWE-476: NULL Pointer Dereference - The application attempts to access memory through a null pointer
2. CWE-401: Missing Release of Memory after Effective Lifetime - The application fails to release memory after it has served its purpose, leading to a memory leak

An attacker can exploit this vulnerability by repeatedly sending h2c upgrade requests to the affected Tomcat server, gradually consuming its memory resources until the server becomes unresponsive.

Remediation

To address this vulnerability, administrators should take the following actions:

1. Update Apache Tomcat to a patched version:

   • For Tomcat 10.x: Update to version 10.0.0-M7 or later
   • For Tomcat 9.x: Update to version 9.0.37 or later
   • For Tomcat 8.5.x: Update to version 8.5.57 or later

2. If immediate updating is not possible, consider one of these workarounds:

   • Disable HTTP/2 support temporarily by removing the HTTP/2 protocol from the connector configuration
   • Place a reverse proxy in front of Tomcat that doesn't support HTTP/2 protocol upgrades
   • Implement rate limiting for connection requests to mitigate potential denial of service attacks

3. Monitor server memory usage closely for any signs of memory leaks or unusual resource consumption patterns

4. After applying patches, restart the Tomcat service to ensure the changes take effect

References

1. Apache Tomcat Security Announcement: https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E
2. Apache Tomcat Bug Report: https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8%40%3Cdev.tomcat.apache.org%3E
3. Debian Security Advisory: https://www.debian.org/security/2020/dsa-4727
4. Ubuntu Security Notice: https://usn.ubuntu.com/4596-1/
5. NetApp Security Advisory: https://security.netapp.com/advisory/ntap-20200724-0003/
6. Oracle Critical Patch Updates:
   • https://www.oracle.com/security-alerts/cpuoct2020.html
   • https://www.oracle.com/security-alerts/cpujan2021.html
   • https://www.oracle.com/security-alerts/cpuApr2021.html
   • https://www.oracle.com//security-alerts/cpujul2021.html
   • https://www.oracle.com/security-alerts/cpujan2022.html
7. openSUSE Security Announcements:
   • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
   • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html