CVE-2023-33953 — Memory Allocation with Excessive Size Value in Google Grpc

CWE-789 — Memory Allocation with Excessive Size ValueCWE-834 — Excessive IterationCWE-770 — Allocation of Resources Without Limits or Throttling9 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 69.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google GrpcGrpc
Timeline
PublishedAug 9
Latest updateJan 15

Description

gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption in the HPACK parser The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDgrpc/grpc1.54.0 — 1.54.3+3
▶RubyGemsgrpc/grpc1.54.0 — 1.54.3+3
▶CVEListV5google/grpc< 1.56.1

🔴Vulnerability Details

4
OSV
CVE-2023-33953: gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional↗2023-08-09
▶
CVEList
Denial-of-Service in gRPC↗2023-08-09
▶
OSV
Excessive Iteration in gRPC↗2023-08-09
▶
GHSA
Excessive Iteration in gRPC↗2023-08-09
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Analytics Risk Matrix: Analytics Server (Google Guava) — CVE-2023-33953↗2025-01-15
▶
Red Hat
gRPC: hpack table accounting errors can lead to denial of service↗2023-08-09
▶
Microsoft
Denial-of-Service in gRPC↗2023-08-08
▶
Debian
CVE-2023-33953: grpc - gRPC contains a vulnerability that allows hpack table accounting errors could le...↗2023
▶
CVE-2023-33953 — Google Grpc vulnerability | cvebase