CVE-2017-8359: Out-of-Bounds Write in gRPC

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

gRPC is an open-source framework developed by Google for building high-performance, language-agnostic remote procedure call (RPC) systems. It provides a flexible and efficient way to connect and communicate between distributed systems. The vulnerability identified as CVE-2017-8359 affects the grpcio package, which is the Python implementation of gRPC. This vulnerability is caused by an out-of-bounds write issue related to the grpc_call_destroy function in the core/lib/surface/call.c file.

Vulnerability Detail

The vulnerability in gRPC allows an attacker to perform a heap-based use-after-free attack, leading to an out-of-bounds write. This can potentially result in remote code execution or a denial-of-service condition. The issue arises when the grpc_call_destroy function is called, causing a use-after-free condition in the heap memory. An attacker can exploit this vulnerability by crafting a malicious request to a gRPC server, triggering the use-after-free condition and potentially executing arbitrary code or crashing the server.

pip install --upgrade "grpcio==6544a2d5d9ecdb64214da1d228886a7d15bbf5c7"

Workaround

If updating the grpcio package is not immediately feasible, a possible workaround is to avoid using the grpc_call_destroy function in the affected code. By carefully managing the lifecycle of gRPC calls and avoiding explicit destruction, the risk of triggering the use-after-free condition can be mitigated. Here is an example of how to modify the code to avoid using grpc_call_destroy:

# Original code
# ... 
call = channel.create_call()
# ... 
call.destroy()

# Modified code
# ... 
call = channel.create_call()
# ... 
# No explicit call to destroy

Conclusion

The vulnerability identified as CVE-2017-8359 in the gRPC framework's grpcio package can lead to an out-of-bounds write issue, potentially enabling remote code execution or causing a denial-of-service condition. It is crucial to update the grpcio package to version 1.3.0 or later to mitigate this vulnerability. If immediate update is not possible, avoiding the use of grpc_call_destroy function can provide a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for grpcio →

FAQ