The vulnerability of the gpr_free function in the core/lib/support/alloc.c of the Google GRPC remote procedure call system, related to out-of-buffer writing, allows a attacker to cause memory corruption and execute arbitrary code.

🗓️ 02 Aug 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

The gpr_free vulnerability in core/lib/support/alloc.c enables out-of-buffer writing, causing memory corruption and code execution.

Reporter	Title	Published	Views	Family All 39
IBM Security Bulletins	Security Bulletin: IBM Security Verify Information Queue uses a Google gRPC framework with multiple vulnerabilities (CVE-2017-7860, CVE-2017-7861, CVE-2017-9431)	20 Jul 202219:27	–	ibm
BDU FSTEC	The vulnerability in the `core/lib/iomgr/error.c` file of the Google GRPC system, related to out-of-buffer writing, allows a attacker to cause memory corruption and execute arbitrary code.	2 Aug 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the `parse_unix` function in the `core/ext/client_channel/parse_address.c` file of the Google GRPC remote procedure call system, related to writing beyond buffer boundaries, allows a attacker to trigger a memory corruption and execute arbitrary code.	2 Aug 202200:00	–	bdu_fstec
CNVD	Google gRPC heap buffer overflow vulnerability (CNVD-2017-06015)	20 Apr 201700:00	–	cnvd
CNVD	Google gRPC Heap Buffer Overflow Vulnerability	20 Apr 201700:00	–	cnvd
CNVD	Google gRPC heap buffer overflow vulnerability (CNVD-2017-08554)	6 Jun 201700:00	–	cnvd
CVE	CVE-2017-7860	14 Apr 201704:30	–	cve
CVE	CVE-2017-7861	14 Apr 201704:30	–	cve
CVE	CVE-2017-9431	5 Jun 201702:47	–	cve
Cvelist	CVE-2017-7860	14 Apr 201704:30	–	cvelist

Vulners

Node

google grpcRange<1.2.2

OR

ibm ibm_security_verify_information_queueMatch10.0.2

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/https://nvd.nist.gov/vuln/detail/CVE-2017-7861
securityfocus	www.securityfocus.com/bid/97694
bugs	www.bugs.chromium.org/p/oss-fuzz/issues/detail
github	www.github.com/grpc/grpc/pull/9833
ibm	www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-information-queue-uses-a-google-grpc-framework-with-multiple-vulnerabilities-cve-2017-7860-cve-2017-7861-cve-2017-9431/
web	www.web.nvd.nist.gov/view/vuln/detail

02 Aug 2022 00:00Current

8.3High risk

Vulners AI Score8.3

CVSS 39.8

CVSS 210

EPSS0.01644

google gRPC gpr_free buffer overflow memory corruption arbitrary code execution crafted file alloc library