CVE-2023-4785 : Lack of error handling in the TCP server in Google's gRPC starting version 1.23

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.

Published 2023-09-13 17:15:10

Updated 2023-09-19 16:02:53

Source Google Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2023-4785

Grpc » Grpc »
Versions from including (>=) 1.54.0 and before (<) 1.54.3
cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*
Matching versions
Grpc » Grpc »
Versions from including (>=) 1.55.0 and before (<) 1.55.3
cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*
Matching versions
Grpc » Grpc »
Versions from including (>=) 1.23.0 and before (<) 1.53.2
cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*
Matching versions
Grpc » Grpc » Version: 1.56.0
cpe:2.3:a:grpc:grpc:1.56.0:*:*:*:*:-:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-4785

EPSS FAQ

0.02%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 3 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-4785

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	Google Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2023-4785

CWE-248 Uncaught Exception

An exception is thrown from a function, but it is not caught.

Assigned by: cve-coordination@google.com (Secondary)

References for CVE-2023-4785

https://github.com/grpc/grpc/pull/33667

[backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion by drfloob · Pull Request #33667 · grpc/grpc · GitHub
Issue Tracking
https://github.com/grpc/grpc/pull/33669

[backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion by drfloob · Pull Request #33669 · grpc/grpc · GitHub
Issue Tracking
https://github.com/grpc/grpc/pull/33670

[backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion by drfloob · Pull Request #33670 · grpc/grpc · GitHub
Issue Tracking
https://github.com/grpc/grpc/pull/33672

[backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion by drfloob · Pull Request #33672 · grpc/grpc · GitHub
Issue Tracking
https://github.com/grpc/grpc/pull/33656

[iomgr][EventEngine] Improve server handling of file descriptor exhaustion by drfloob · Pull Request #33656 · grpc/grpc · GitHub
Issue Tracking;Patch

Jump to

Vulnerability Details : CVE-2023-4785

Products affected by CVE-2023-4785

Exploit prediction scoring system (EPSS) score for CVE-2023-4785

CVSS scores for CVE-2023-4785

CWE ids for CVE-2023-4785

References for CVE-2023-4785