Vulnerability · Published Mar 25, 2022 · Assigned by GitHub_M

CVE-2022-24777Denial of Service via reachable assertion in grpc-swift

High 7.5

In plain English

A high-severity security flaw in grpc-swift from grpc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.2%top 32.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will crash, dropping all in flight connections and requests. This issue is fixed in version 1.7.2. There are currently no known workarounds.

Affected products (as reported)

Vendor	Product	Versions
grpc	grpc-swift	< 1.7.2

Weakness: CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/grpc/grpc-swift/security/advisories/GHSA-r6ww-5963-7r95 x_refsource_CONFIRM
https://github.com/grpc/grpc-swift/commit/858f977f2a51fca2292f384cf7a108dc2e73a3bd x_refsource_MISC