Resource exhaustion in otelgrpc - CVE-2023-47108

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU84507

Resource exhaustion in otelgrpc - CVE-2023-47108

Published: December 18, 2023


Vulnerability identifier: #VU84507
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-47108
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available
Affected software:
otelgrpc
PowerStore 9200T
PowerStore 9000T
PowerStore 3200T
PowerStore 5000T
PowerStore 7000T
PowerStore 5200T
PowerStore 3000T
PowerStore 1200T
PowerStore 1000T
PowerStore 500T
PowerStoreT OS
IBM Cloud Pak for Data Scheduling
Red Hat Advanced Cluster Management for Kubernetes
Custom Metrics Autoscaler Operator for Red Hat OpenShift
APEX Cloud Platform for Red Hat OpenShift
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Amazon Linux AMI
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise High Performance Computing 15 SP2
SUSE Linux Enterprise Server 15 SP2
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Containers Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
openSUSE Leap
Fedora
containerd
ObjectScale
Red Hat OpenShift Container Platform
Dell EMC VxRail Appliance
RSA Authentication Manager
Splunk Enterprise
toolbox (Red Hat package)
rust-bootupd (Red Hat package)
coreos-installer (Red Hat package)
runc (Red Hat package)
containernetworking-plugins (Red Hat package)
containerd
containerd-devel
containerd-ctr
skopeo (Red Hat package)
crun (Red Hat package)
golang-opentelemetry-otel
golang-opentelemetry-contrib
cri-o (Red Hat package)
cri-tools (Red Hat package)
buildah (Red Hat package)
containers-common (Red Hat package)
amazon-cloudwatch-agent
conmon (Red Hat package)
ignition (Red Hat package)
container-selinux (Red Hat package)
catch (Red Hat package)
etcdctl
etcd
podman (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
openshift-ansible (Red Hat package)
rust-afterburn (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
ovn23.06 (Red Hat package)
docker
docker-debuginfo
docker-bash-completion
docker-zsh-completion
docker-fish-completion
docker-rootless-extras
ostree (Red Hat package)
rpm-ostree (Red Hat package)
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM CICS TX Standard

Detailed vulnerability description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to grpc Unary Server Interceptor does not properly control consumption of internal resources when processing multiple requests. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


How to mitigate CVE-2023-47108

Install updates from vendor's website.

Sources