CVE-2025-24356

fastd is a VPN daemon which tunnels IP packets and Ethernet frames over UDP. When receiving a data packet from an unknown IP address/port combination, fastd will assume that one of its connected peers has moved to a new address and initiate a reconnect by sending a handshake packet. This "fast reconnect" avoids having to wait for a session timeout (up to ~90s) until a new connection is established. Even a 1-byte UDP packet just containing the fastd packet type header can trigger a much larger handshake packet (~150 bytes of UDP payload). Including IPv4 and UDP headers, the resulting amplification factor is roughly 12-13. By sending data packets with a spoofed source address to fastd instances reachable on the internet, this amplification of UDP traffic might be used to facilitate a Distributed Denial of Service attack. This vulnerability is fixed in v23.

fastd is a VPN daemon which tunnels IP packets and Ethernet frames over UDP. When receiving a data packet from an unknown IP address/port combination, fastd will assume that one of its connected peers has moved to a new address and initiate a reconnect by sending a handshake packet. This "fast reconnect" avoids having to wait for a session timeout (up to ~90s) until a new connection is established. Even a 1-byte UDP packet just containing the fastd packet type header can trigger a much larger handshake packet (~150 bytes of UDP payload). Including IPv4 and UDP headers, the resulting amplification factor is roughly 12-13. By sending data packets with a spoofed source address to fastd instances reachable on the internet, this amplification of UDP traffic might be used to facilitate a Distributed Denial of Service attack. This vulnerability is fixed in v23.

fastd es una VPN daemon que tuneliza paquetes IP y tramas Ethernet sobre UDP. Al recibir un paquete de datos de una combinación desconocida de dirección IP/puerto, fastd asumirá que uno de sus pares conectados se ha mudado a una nueva dirección e iniciará una reconexión enviando un paquete handshake. Esta "reconexión rápida" evita tener que esperar a que se agote el tiempo de espera de la sesión (hasta ~90 s) hasta que se establezca una nueva conexión. Incluso un paquete UDP de 1 byte que solo contenga el encabezado de tipo de paquete fastd puede activar un paquete handshakee mucho más grande (~150 bytes de UDP payload). incluida IPv4 y encabezados UDP, el factor de amplificación resultante es aproximadamente 12-13. Al enviar paquetes de datos con una dirección de origen falsificada a instancias de fastd accesibles en Internet, esta amplificación del tráfico UDP podría usarse para facilitar un ataque de denegación de servicio distribuido. Esta vulnerabilidad se corrigió en la v23.