CVE-2018-6343

Step 1: Connection Establishment: The attacker establishes a TLS 1.3 connection with a server using Proxygen.

Step 2: Frame Injection: The attacker crafts a malicious Certificate/CertificateRequest HTTP/2 frame.

Step 3: Frame Transmission: The attacker sends the crafted frame to the server.

Step 4: Vulnerability Trigger: The Proxygen library attempts to process the frame.

Step 5: Null Dereference: The code attempts to use a secondary authentication manager without validating its existence, leading to a null pointer dereference.

Step 6: Denial of Service: The null pointer dereference causes the server process to crash, resulting in a denial of service.

The vulnerability lies within Proxygen's handling of secondary authentication managers during the parsing of Certificate/CertificateRequest HTTP/2 frames over a TLS 1.3 connection. Specifically, the code fails to validate if a secondary authentication manager is initialized before attempting to dereference it. This leads to a null pointer dereference when processing the frame, causing the program to crash. The root cause is a missing null check before accessing the secondary authentication manager's methods. This is a classic example of a logic error leading to a crash and subsequent DoS condition.