CVE-2024-37168 @grpc/grpc-js can allocate memory for incoming messages well above configured limits

2024-06-1021:32:06

CWE-789

GitHub_M

github.com

vulnerability

memory allocation

incoming messages

excessive

grpc

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.1 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.2%

JSON

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the grpc.max_receive_message_length channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.

CNA Affected

[
  {
    "vendor": "grpc",
    "product": "grpc-node",
    "versions": [
      {
        "status": "affected",
        "version": ">= 1.10.0, < 1.10.9"
      },
      {
        "status": "affected",
        "version": ">= 1.9.0, < 1.9.15"
      },
      {
        "status": "affected",
        "version": "< 1.8.22"
      }
    ]
  }
]