CVE-2024-37168: gRPC grpc-js unbounded memory allocation on incoming messages

CVE-2024-37168 · Severity: low · CVSS 3.1 · Published 2024-06-10

@grpc/grpc-js is a Node.js library used to build gRPC services that communicate with other services over the network. The library fails to enforce configured message size limits in two scenarios: when oversized messages arrive on the wire, and when compressed messages decompress beyond the limit. An attacker can send crafted messages to exhaust a server's available memory, causing service denial or crashes.

Technologies: @grpc/grpc-js (npm). Vendors: npm.

Quick answers

Is CVE-2024-37168 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-37168 being exploited in the wild.
How severe is CVE-2024-37168?
Low severity, with a CVSS score of 3.1, published 10 June 2024.
Which products and versions are affected?
@grpc/grpc-js (npm) SEMVER:introduced=1.10.0,fixed=1.10.9.
Is there a fix for CVE-2024-37168?
Yes. @grpc/grpc-js (npm): upgrade to 1.10.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-37168 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-37168?
Check whether you run @grpc/grpc-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @grpc/grpc-js (npm): upgrade to 1.10.9 or later
    npm install @grpc/grpc-js@1.10.9

Technical details

The vulnerability is a memory allocation bypass (CWE-789) in @grpc/grpc-js where the grpc.max_receive_message_length channel option is not properly enforced. Two code paths allow excessive memory allocation: (1) oversized messages are fully buffered before being discarded, and (2) compressed messages are decompressed into memory even if they exceed the limit (and on servers are not discarded afterward). An attacker on the network can send malicious gRPC messages without authentication to trigger unbounded memory allocation. This enables denial-of-service attacks targeting service availability. Patches are available in versions 1.10.9, 1.9.15, and 1.8.22.

Affected products

  • Google grpc-js <1.8.22, >=1.9.0 <1.9.15, >=1.10.0 <1.10.9

Identifiers

  • CVE-2024-37168
  • GHSA-7v5v-9h63-cj86

Timeline

  • 2024-06-10: disclosed
  • 2024-06-10: patched: Versions 1.10.9, 1.9.15, and 1.8.22 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.