CVE-2023-33953 Denial-of-Service in gRPC

What is CVE-2023-33953?

CVE-2023-33953 is a high-severity denial of service vulnerability in Google gRPC, published on 9 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks:

- Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser

The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client.

The unbounded memory buffering bugs:

- The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb. - HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse. - gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…

Weakness: CWE-770, CWE-834, CWE-789

Which versions are affected by CVE-2023-33953?

17 open source packages ship an affected version, including grpcio and grpc. It affects 1 product.

Products include Grpc Grpc.

How do I fix CVE-2023-33953?

Upgrade grpcio to a fixed version for your release line: 1.53.2, 1.54.3, 1.55.2 or 1.56.2.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-33953 being exploited?

There is no known exploitation of CVE-2023-33953 in the wild and no public exploit code.

Other vulnerabilities in Google gRPC

• CVE-2017-9431 Memory corruption in n/a Critical 9.8
• CVE-2017-8359 Use after free in n/a Critical 9.8
• CVE-2017-7860 Memory corruption in n/a Critical 9.8
• CVE-2017-7861 Memory corruption in n/a Critical 9.8
• CVE-2026-33186 gRPC-Go has an authorization bypass via missing leading slash in :path Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-27911, AZL-34770, AZL-39394, BELL-CVE-2023-33953, DEBIAN-CVE-2023-33953, ECHO-9fe3-9f38-13ad and 4 more.