Critical Out-of-Bounds Write Vulnerability in gRPC Package
Summary
CVE-2017-8359: Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/call.c. Affects grpc across 6 version ranges.
< 1.3.2-0.1
< 3d921fffb7ce29f03329e411711d0751328c761a
< 5fb5efffb108d71e711ae92548c32c69b6439eff
< 8050b9cbc271307e5a716a9d782803d09b0d6f2d
< 98376f0ac604da54957d545abe4bb01b5255b73d
< c25267fd7dc3d549ef8aace4909c95eac9b0cca9
Fixed in 1.3.2-0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gRPC is a high-performance, open-source universal RPC framework that enables communication between applications in a distributed environment. It supports multiple programming languages and is widely used for microservices architecture. The vulnerability in question affects various versions of the gRPC package across multiple Debian ecosystems, making it crucial for developers to address this issue promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2017-8359, is an out-of-bounds write caused by a heap-based use-after-free error related to the grpc_call_destroy function in the core library. This flaw can lead to memory corruption, potentially allowing an attacker to execute arbitrary code, crash the application, or gain unauthorized access to sensitive data. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a critical risk to affected systems.
How To Fix
Minimum fixed version
1.3.2-0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade grpcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing strict memory management practices and monitoring for unusual application behavior as a temporary workaround. However, this is not a substitute for applying the official fix.
Conclusion
The CVE-2017-8359 vulnerability poses a significant risk to applications using the gRPC package. It is essential for developers to upgrade to the fixed version promptly and consider using tools like Vulert for ongoing vulnerability monitoring. Addressing this issue will help maintain the security and integrity of applications relying on gRPC.
See every vulnerability recorded for grpc →
FAQ
CVE-2017-8359 is a critical vulnerability in the gRPC package that allows for an out-of-bounds write due to a heap-based use-after-free error.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to memory corruption, allowing attackers to execute arbitrary code, crash applications, or access sensitive data.
It is strongly recommended to upgrade to version 1.3.2-0.1 or later of the gRPC package to mitigate the risk associated with this vulnerability.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for grpc.
