Allocation of Resources Without Limits or Throttling in gRPC - CVE-2023-33953

Vulnerability identifier: #VU80828

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-33953

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

gRPC
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
openSUSE Leap Micro
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Public Cloud Module
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Development Tools Module
Basesystem Module
Python 3 Module
SUSE Package Hub 15
openSUSE Leap
IBM Observability with Instana
IBM Watson Discovery for IBM Cloud Pak for Data
DataStage on Cloud Pak for Data
Oracle Business Intelligence Enterprise Edition
IBM Watson Machine Learning Accelerator
Storage Resource Manager
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
Juniper Secure Analytics (JSA)
IBM Qradar SIEM
rhc-worker-playbook (Red Hat package)
opencensus-proto-source
python311-abseil
libgrpc8
libgrpc++1-debuginfo
libgrpc++1
libgrpc8-debuginfo
grpc-debuginfo
grpc-debugsource
python3-grpcio-debuginfo
python3-grpcio
libgrpc37
grpc-devel-debuginfo
libgrpc1_60-debuginfo
libgrpc++1_60
libgrpc++1_60-debuginfo
grpc-source
upb-devel
grpc-devel
libupb37
libgrpc37-debuginfo
libgrpc1_60
libupb37-debuginfo
python-grpcio-debugsource
python311-grpcio-debuginfo
python311-grpcio
python311-protobuf
libprotobuf-lite25_1_0-64bit
libprotobuf25_1_0-64bit
libprotoc25_1_0-64bit-debuginfo
protobuf-devel
libprotobuf25_1_0-64bit-debuginfo
libprotoc25_1_0-64bit
libprotobuf-lite25_1_0-64bit-debuginfo
protobuf-devel-debuginfo
protobuf-debugsource
libprotobuf25_1_0
protobuf-java
libprotobuf-lite25_1_0
libprotobuf-lite25_1_0-32bit-debuginfo
libprotoc25_1_0
libprotobuf-lite25_1_0-debuginfo
libprotoc25_1_0-debuginfo
libprotobuf-lite25_1_0-32bit
libprotobuf25_1_0-32bit-debuginfo
libprotoc25_1_0-32bit
libprotobuf25_1_0-debuginfo
libprotoc25_1_0-32bit-debuginfo
libprotobuf25_1_0-32bit
abseil-cpp-debugsource
libabsl2308_0_0-32bit
libabsl2308_0_0-64bit
libabsl2308_0_0-32bit-debuginfo
libabsl2308_0_0-64bit-debuginfo
libabsl2308_0_0-debuginfo
abseil-cpp-devel
libabsl2308_0_0
libre2-11-32bit
libre2-11-debuginfo
re2-devel
libre2-11
libre2-11-32bit-debuginfo
re2-debugsource
libre2-11-64bit
libre2-11-64bit-debuginfo
Dell EMC Storage Monitoring and Reporting (SMR)

Install updates from vendor's website.

gRPC - update to 1.53.2
IBM Observability with Instana - update to 1.0.297
Juniper Secure Analytics (JSA) - update to 7.5.0 UP12 IF03
IBM Qradar SIEM - update to 7.5.0 Update Pack 12 IF03
rhc-worker-playbook (Red Hat package) - update to 0.1.10-1.el9_5
opencensus-proto-source - update to 0.3.0+git.20200721-150400.9.3.1
IBM Watson Machine Learning Accelerator - update to 1.2.3 601632-wmla
python311-abseil - update to 1.4.0-150400.9.3.1
libgrpc8 - update to 1.25.0-150200.3.10.1
libgrpc++1-debuginfo - update to 1.25.0-150200.3.10.1
libgrpc++1 - update to 1.25.0-150200.3.10.1
libgrpc8-debuginfo - update to 1.25.0-150200.3.10.1
grpc-debuginfo - addressed in versions 1.25.0-150200.3.10.1, 1.60.0-150400.8.3.2
grpc-debugsource - addressed in versions 1.25.0-150200.3.10.1, 1.60.0-150400.8.3.2
python3-grpcio-debuginfo - update to 1.25.0-150200.3.10.1
python3-grpcio - update to 1.25.0-150200.3.10.1
libgrpc37 - update to 1.60.0-150400.8.3.2
grpc-devel-debuginfo - update to 1.60.0-150400.8.3.2
libgrpc1_60-debuginfo - update to 1.60.0-150400.8.3.2
libgrpc++1_60 - update to 1.60.0-150400.8.3.2
libgrpc++1_60-debuginfo - update to 1.60.0-150400.8.3.2
grpc-source - update to 1.60.0-150400.8.3.2
upb-devel - update to 1.60.0-150400.8.3.2
grpc-devel - update to 1.60.0-150400.8.3.2
libupb37 - update to 1.60.0-150400.8.3.2
libgrpc37-debuginfo - update to 1.60.0-150400.8.3.2
libgrpc1_60 - update to 1.60.0-150400.8.3.2
libupb37-debuginfo - update to 1.60.0-150400.8.3.2
python-grpcio-debugsource - update to 1.60.0-150400.9.3.2
python311-grpcio-debuginfo - update to 1.60.0-150400.9.3.2
python311-grpcio - update to 1.60.0-150400.9.3.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.3
python311-protobuf - update to 4.25.1-150400.9.3.1
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
Storage Resource Manager - update to 5.0.1.0
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1
watsonx Assistant Cartridge - update to 5.1.1
libprotobuf-lite25_1_0-64bit - update to 25.1-150400.9.3.1
libprotobuf25_1_0-64bit - update to 25.1-150400.9.3.1
libprotoc25_1_0-64bit-debuginfo - update to 25.1-150400.9.3.1
protobuf-devel - update to 25.1-150400.9.3.1
libprotobuf25_1_0-64bit-debuginfo - update to 25.1-150400.9.3.1
libprotoc25_1_0-64bit - update to 25.1-150400.9.3.1
libprotobuf-lite25_1_0-64bit-debuginfo - update to 25.1-150400.9.3.1
protobuf-devel-debuginfo - update to 25.1-150400.9.3.1
protobuf-debugsource - update to 25.1-150400.9.3.1
libprotobuf25_1_0 - update to 25.1-150400.9.3.1
protobuf-java - update to 25.1-150400.9.3.1
libprotobuf-lite25_1_0 - update to 25.1-150400.9.3.1
libprotobuf-lite25_1_0-32bit-debuginfo - update to 25.1-150400.9.3.1
libprotoc25_1_0 - update to 25.1-150400.9.3.1
libprotobuf-lite25_1_0-debuginfo - update to 25.1-150400.9.3.1
libprotoc25_1_0-debuginfo - update to 25.1-150400.9.3.1
libprotobuf-lite25_1_0-32bit - update to 25.1-150400.9.3.1
libprotobuf25_1_0-32bit-debuginfo - update to 25.1-150400.9.3.1
libprotoc25_1_0-32bit - update to 25.1-150400.9.3.1
libprotobuf25_1_0-debuginfo - update to 25.1-150400.9.3.1
libprotoc25_1_0-32bit-debuginfo - update to 25.1-150400.9.3.1
libprotobuf25_1_0-32bit - update to 25.1-150400.9.3.1
abseil-cpp-debugsource - update to 20230802.1-150400.10.4.1
libabsl2308_0_0-32bit - update to 20230802.1-150400.10.4.1
libabsl2308_0_0-64bit - update to 20230802.1-150400.10.4.1
libabsl2308_0_0-32bit-debuginfo - update to 20230802.1-150400.10.4.1
libabsl2308_0_0-64bit-debuginfo - update to 20230802.1-150400.10.4.1
libabsl2308_0_0-debuginfo - update to 20230802.1-150400.10.4.1
abseil-cpp-devel - update to 20230802.1-150400.10.4.1
libabsl2308_0_0 - update to 20230802.1-150400.10.4.1
libre2-11-32bit - update to 20240201-150400.9.3.1
libre2-11-debuginfo - update to 20240201-150400.9.3.1
re2-devel - update to 20240201-150400.9.3.1
libre2-11 - update to 20240201-150400.9.3.1
libre2-11-32bit-debuginfo - update to 20240201-150400.9.3.1
re2-debugsource - update to 20240201-150400.9.3.1
libre2-11-64bit - update to 20240201-150400.9.3.1
libre2-11-64bit-debuginfo - update to 20240201-150400.9.3.1

• https://cloud.google.com/support/bulletins#gcp-2023-022

• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator
• Allocation of resources without limits or throttling in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• SUSE update for abseil-cpp, grpc, opencensus-proto, protobuf, python-abseil, python-grpcio, re2
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Red Hat Enterprise Linux 9 update for rhc-worker-playbook
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component update for gRPC
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in IBM QRadar SIEM
• IBM DataStage on Cloud Pak for Data update for gRPC
• Multiple vulnerabilities in Juniper Secure Analytics
• SUSE update for grpc