CVE-2022-24777 Denial of Service via reachable assertion in grpc-swift

What is CVE-2022-24777?

CVE-2022-24777 is a high-severity denial of service vulnerability in grpc-swift, published on 25 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will crash, dropping all in flight connections and requests. This issue is fixed in version 1.7.2. There are currently no known workarounds.

Weakness: CWE-617

Which versions are affected by CVE-2022-24777?

2 open source packages ship an affected version, including github.com/grpc/grpc-swift. It affects 1 product.

Products include Linuxfoundation Grpc Swift.

How do I fix CVE-2022-24777?

Upgrade github.com/grpc/grpc-swift to 1.7.2 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-24777 being exploited?

There is no known exploitation of CVE-2022-24777 in the wild and no public exploit code.

Other vulnerabilities in grpc-swift

• CVE-2021-36153 Incomplete Internal State Distinction in GRPCWebToHTTP2ServerCodec High 7.5
• CVE-2021-36154 Uncontrolled Recursion in HTTP2ToRawGRPCServerCodec High 7.5
• CVE-2021-36155 Uncontrolled Resource Consumption in LengthPrefixedMessageReader High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r6ww-5963-7r95.