NRDAX-T0394 - Connection ID Retirement Infinite Loop

mechanism

The node's connection-ID retirement handler does not terminate/converge when RETIRE_CONNECTION_ID and NEW_CONNECTION_ID sequence numbers are exchanged across multiple migrated paths in a circular pattern (retiring the CID in use on path A from path B and vice versa), violating the RFC 9000 §19.16 invariant that a packet must not retire the CID it was sent on. An attacker who completes the handshake and drives path migration across ≥2 paths while crafting this circular retirement sequence triggers an unbounded loop in the retirement logic (CWE-835), pinning the victim at 100% CPU - a post-handshake remote compute-exhaustion DoS. Fix-class is bounding/validating cross-path CID retirement transitions so the state machine always reaches a valid exit, distinct from fixes that bound the retired-CID store size for single-path floods.

instances (1)

related (compute_amp)

cite

https://nrdax.com/techniques/NRDAX-T0394

@misc{nrdax_NRDAX_T0394,
  title = {Connection ID Retirement Infinite Loop (NRDAX-T0394)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0394},
}

{
  "id": "nrdax-NRDAX-T0394",
  "type": "dataset",
  "title": "Connection ID Retirement Infinite Loop (NRDAX-T0394)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0394",
  "publisher": "NRDAX Registry"
}

[![NRDAX-T0394 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0394.svg)](https://nrdax.com/techniques/NRDAX-T0394-connection-id-retirement-infinite-loop)