Remote DoS Vulnerability in rust-tonic Package - CVE-2024-47609
Summary
UBUNTU-CVE-2024-47609: Tonic is a native gRPC client & server implementation with async/await support. Affects rust-tonic versions 0.10.2+dfsg-10 – 0.10.2+dfsg-9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rust-tonic package is a native gRPC client and server implementation that supports asynchronous programming with async/await. It is designed to facilitate communication between services in a distributed system, providing a robust framework for building efficient and scalable applications. However, it has been identified that certain versions of rust-tonic are susceptible to a remote denial-of-service (DoS) attack, which can compromise the stability of applications relying on this package.
Vulnerability Detail
The vulnerability arises when using the tonic::transport::Server, where a remote attacker can exploit the server by causing the accept call to fail with unhandled errors. This leads to the accept loop exiting, effectively shutting down the server. The issue is particularly concerning as it can be triggered without authentication, allowing unauthorized users to disrupt service availability. The vulnerability has been assigned the identifier CVE-2024-47609 and has a CVSS score of 4.0, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement error handling in your server code to manage unexpected errors during the accept call. This may involve wrapping the accept call in a loop that can handle exceptions gracefully, preventing the server from exiting unexpectedly. Example code snippet:
loop { match server.accept().await {
Ok(stream) => { /* handle stream */ },
Err(e) => { /* log error and continue */ }
}
}
Conclusion
The rust-tonic package has a vulnerability (CVE-2024-47609) that can lead to remote denial-of-service attacks. It is crucial for developers to upgrade to version 0.12.3 or higher to mitigate this risk. Implementing error handling can serve as a temporary measure while awaiting the upgrade.
See every vulnerability recorded for rust-tonic →
FAQ
CVE-2024-47609 is a vulnerability in the rust-tonic package that allows remote attackers to cause a denial-of-service (DoS) by exploiting unhandled errors in the server's accept loop.
If your application uses rust-tonic versions prior to 0.12.3, it is likely affected by this vulnerability. You can use tools like Vulert to check for vulnerabilities in your dependencies.
If an immediate upgrade is not possible, consider implementing error handling in your server code as a temporary workaround to prevent unexpected exits.
The vulnerability can lead to service disruptions, making your application unavailable to users, which can result in loss of revenue and trust.
Detailed information about CVE-2024-47609 can be found in the Ubuntu security notices and on the official GitHub repository.
