CVE-2024-37168: @grpc/grpc-js can allocate memory for incoming messages well above configured limits
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.
Other sources
Impact There are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channel option:
1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded. 2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded.
Patches
This has been patched in versions 1.10.9, 1.9.15, and 1.8.22
— GitHub
gRPC on Node.js is vulnerable to a denial of service, caused by a flaw with memory allocation with excessive size value. By sending specially crafted messages, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37168?
CVE-2024-37168 has a severity rating that indicates it could potentially lead to denial of service due to memory allocation issues.
How do I fix CVE-2024-37168?
To remediate CVE-2024-37168, upgrade to versions 1.10.9, 1.9.15, or 1.8.22 of the @grpc/grpc-js package.
What systems are affected by CVE-2024-37168?
CVE-2024-37168 affects the @grpc/grpc-js package versions prior to 1.10.9, 1.9.15, and 1.8.22 as well as certain IBM products.
What are the potential consequences of CVE-2024-37168?
Exploitation of CVE-2024-37168 can result in excessive memory consumption and potential denial of service.
Is CVE-2024-37168 being actively exploited?
As of the latest information, there is no evidence to suggest that CVE-2024-37168 is actively being exploited in the wild.