Resource exhaustion in otelgrpc - CVE-2023-47108

Vulnerability identifier: #VU84507

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-47108

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to grpc Unary Server Interceptor does not properly control consumption of internal resources when processing multiple requests. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

otelgrpc
PowerStore 9200T
PowerStore 9000T
PowerStore 3200T
PowerStore 5000T
PowerStore 7000T
PowerStore 5200T
PowerStore 3000T
PowerStore 1200T
PowerStore 1000T
PowerStore 500T
PowerStoreT OS
IBM Cloud Pak for Data Scheduling
Red Hat Advanced Cluster Management for Kubernetes
Custom Metrics Autoscaler Operator for Red Hat OpenShift
APEX Cloud Platform for Red Hat OpenShift
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Amazon Linux AMI
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise High Performance Computing 15 SP2
SUSE Linux Enterprise Server 15 SP2
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Containers Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
openSUSE Leap
Fedora
containerd
ObjectScale
Red Hat OpenShift Container Platform
Dell EMC VxRail Appliance
RSA Authentication Manager
Splunk Enterprise
toolbox (Red Hat package)
rust-bootupd (Red Hat package)
coreos-installer (Red Hat package)
runc (Red Hat package)
containernetworking-plugins (Red Hat package)
containerd
containerd-devel
containerd-ctr
skopeo (Red Hat package)
crun (Red Hat package)
golang-opentelemetry-otel
golang-opentelemetry-contrib
cri-o (Red Hat package)
cri-tools (Red Hat package)
buildah (Red Hat package)
containers-common (Red Hat package)
amazon-cloudwatch-agent
conmon (Red Hat package)
ignition (Red Hat package)
container-selinux (Red Hat package)
catch (Red Hat package)
etcdctl
etcd
podman (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
openshift-ansible (Red Hat package)
rust-afterburn (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
ovn23.06 (Red Hat package)
docker
docker-debuginfo
docker-bash-completion
docker-zsh-completion
docker-fish-completion
docker-rootless-extras
ostree (Red Hat package)
rpm-ostree (Red Hat package)
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM CICS TX Standard

Install updates from vendor's website.

otelgrpc - update to 0.46.0
containerd - update to 1.6.28
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.9.3, 2.10.5
Red Hat OpenShift Container Platform - addressed in versions 4.12.48, 4.13.30, 4.13.33, 4.13.51, 4.14.6, 4.14.7, 4.14.9, 4.14.11, 4.14.18, 4.14.22, 4.14.35, 4.14.36, 4.14.38, 4.14.39, 4.14.44, 4.15.0, 4.15.5, 4.15.10, 4.15.13, 4.15.14, 4.15.31, 4.15.32, 4.16.0, 4.16.12
Dell EMC VxRail Appliance - addressed in versions 7.0.540, 8.0.311, 8.321
RSA Authentication Manager - addressed in versions 8.7 SP2 Patch 5, 8.7 SP2 Patch 6
Splunk Enterprise - addressed in versions 9.1.6, 9.2.3, 9.3.1
toolbox (Red Hat package) - update to 0.1.2-1.rhaos4.15.el9
rust-bootupd (Red Hat package) - update to 0.2.17-1.el9
coreos-installer (Red Hat package) - update to 0.17.0-3.rhaos4.15.el9
runc (Red Hat package) - update to 1.1.12-1.rhaos4.15.el9
ObjectScale - update to 1.4.0
containernetworking-plugins (Red Hat package) - update to 1.4.0-1.rhaos4.14.el8
containerd - update to 1.7.11-1
containerd - addressed in versions 1.7.21-16.94.1, 1.7.21-150000.117.1
containerd-devel - update to 1.7.21-150000.117.1
containerd-ctr - update to 1.7.21-150000.117.1
skopeo (Red Hat package) - update to 1.11.2-21.1.rhaos4.15.el9
crun (Red Hat package) - update to 1.14-1.rhaos4.15.el9
golang-opentelemetry-otel - update to 1.17.0-1.fc41
golang-opentelemetry-contrib - update to 1.17.0-2.fc41
cri-o (Red Hat package) - addressed in versions 1.25.5-6.rhaos4.12.gitfcf6ef3.el8, 1.26.4-9.1.rhaos4.13.gite26e057.el8, 1.26.4-9.1.rhaos4.13.gite26e057.el9, 1.27.2-7.rhaos4.14.git1cc7a64.el8, 1.27.2-7.rhaos4.14.git1cc7a64.el9, 1.28.3-14.rhaos4.15.git33aabd8.el9
cri-tools (Red Hat package) - update to 1.28.0-3.el9
buildah (Red Hat package) - update to 1.29.1-20.2.rhaos4.15.el9
containers-common (Red Hat package) - update to 1-37.rhaos4.13.el9
amazon-cloudwatch-agent - update to 1.300032.3-1
conmon (Red Hat package) - update to 2.1.7-1.2.rhaos4.14.el9
Multicluster Engine for Kubernetes - addressed in versions 2.6.4, 2.7.2
Custom Metrics Autoscaler Operator for Red Hat OpenShift - update to 2.12.1-376
ignition (Red Hat package) - update to 2.16.2-2.rhaos4.15.el9
container-selinux (Red Hat package) - update to 2.228.1-1.rhaos4.15.el9
APEX Cloud Platform for Red Hat OpenShift - update to 03.02.04.00
catch (Red Hat package) - update to 3.5.1-1.el9
etcdctl - update to 3.5.12-150000.7.6.1
etcd - update to 3.5.12-150000.7.6.1
etcd - update to 3.5.13-1.fc41
PowerStoreT OS - update to 3.6.1.5-2456810
podman (Red Hat package) - addressed in versions 4.4.1-1.rhaos4.12.el8, 4.4.1-21.rhaos4.15.el9
openshift (Red Hat package) - addressed in versions 4.12.0-202401181308.p0.g6df2177.assembly.stream.el8, 4.12.0-202401181308.p0.g6df2177.assembly.stream.el9, 4.13.0-202401150908.p0.gdedb61b.assembly.stream.el8, 4.13.0-202401150908.p0.gdedb61b.assembly.stream.el9, 4.14.0-202401041534.p0.g5c56cc3.assembly.stream.el8, 4.14.0-202401041534.p0.g5c56cc3.assembly.stream.el9, 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.14.0-202401040833.p0.g286cfa5.assembly.stream.el8, 4.14.0-202401040833.p0.g286cfa5.assembly.stream.el9, 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package) - update to 4.15.0-202401231232.p0.gba252ab.assembly.stream.el9
openshift-ansible (Red Hat package) - update to 4.15.0-202402162207.p0.g1c9b99e.assembly.stream.el9
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.16.0
rust-afterburn (Red Hat package) - update to 5.4.3-2.rhaos4.15.el9
kernel (Red Hat package) - addressed in versions 5.14.0-284.48.1.el9_2, 5.14.0-284.54.1.el9_2
kernel-rt (Red Hat package) - addressed in versions 5.14.0-284.48.1.rt14.333.el9_2, 5.14.0-284.54.1.rt14.339.el9_2
IBM CICS TX Standard - update to 11.1.0.0 ifix18
ovn23.06 (Red Hat package) - update to 23.06.1-82.el9fdp
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF004, 24.0.1-IF001
docker - addressed in versions 26.1.5_ce-98.120.1, 26.1.5_ce-150000.212.1
docker-debuginfo - addressed in versions 26.1.5_ce-98.120.1, 26.1.5_ce-150000.212.1
docker-bash-completion - addressed in versions 26.1.5_ce-98.120.1, 26.1.5_ce-150000.212.1
docker-zsh-completion - update to 26.1.5_ce-150000.212.1
docker-fish-completion - update to 26.1.5_ce-150000.212.1
docker-rootless-extras - update to 26.1.5_ce-150000.212.1
IBM Observability with Instana - update to 279
ostree (Red Hat package) - update to 2023.8-3.el9
rpm-ostree (Red Hat package) - update to 2024.2-1.el9

• https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw
• https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322
• https://github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333b
• https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327
• https://github.com/open-telemetry/opentelemetry-go-contrib/blob/instrumentation/google.golang.org/grpc/otelgrpc/v0.45.0/instrumentation/google.golang.org/grpc/otelgrpc/config.go#L138
• https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProvider

• Denial of service in OpenTelemetry otelgrpc
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• OpenShift Container Platform 4.13 update for opentelemetry-go-contrib
• Multiple vulnerabilities in containerd
• Denial of service in OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Resource exhaustion in IBM CICS TX Standard
• Multiple vulnerabilities in IBM Cloud Pak for Data Scheduling
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.9
• Multiple vulnerabilities in Custom Metrics Autoscaler Operator for Red Hat OpenShift
• Fedora 41 update for golang-opentelemetry-contrib, golang-opentelemetry-otel
• Fedora 41 update for etcd
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation
• Amazon Linux AMI update for containerd
• Amazon Linux AMI update for amazon-cloudwatch-agent
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• SUSE update for containerd
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• SUSE update for containerd
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.10
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Splunk Enterprise update for third-party components
• SUSE update for etcd
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• SUSE update for docker
• SUSE update for docker
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Dell VxRail Appliance
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Dell VxRail Appliance 7.x update for third-party components
• Dell VxRail Appliance 8.x update for third-party components
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• RSA Authentication Manager update for third-party components
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in Dell PowerStoreT OS