Bug 2239017 (CVE-2023-4785)

Summary:	CVE-2023-4785 gRPC: file descriptor exhaustion leads to denial of service
Product:	[Other] Security Response	Reporter:	Chess Hazlett <chazlett>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, agarcial, aoconnor, asegurap, bbuckingham, bcourt, bdettelb, caswilli, crarobin, dfreiber, dkuc, ehelms, fdupont, fjansen, hkataria, jburrell, jmadigan, jmitchel, jsherril, jtanner, kaycoth, kshier, luizcosta, lzap, mhulan, mkleinhe, mresvani, ngough, nmoumoul, nweather, oezr, orabin, pamccart, pcreech, rchan, rogbas, stcannon, sthirugn, tcarlin, tfister, tkasparek, vkrizan, vkumar, vmugicag, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	grpc 1.53.2, grpc 1.54.3, grpc 1.55.3, grpc 1.56.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in gRPC. Lack of error handling in the TCP server in Google's gRPC, starting in version 1.23 on POSIX-compatible platforms (for example, Linux), allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++, Python, and Ruby are affected, but gRPC Java and Go are NOT affected.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2239018, 2239187, 2239188
Bug Blocks:	2238998

Description Chess Hazlett 2023-09-14 19:38:35 UTC

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.

Comment 3 Guilherme de Almeida Suckevicz 2023-09-15 19:15:13 UTC

Created etcd tracking bugs for this issue:

Affects: openstack-rdo [bug 2239188]


Created golang-google-grpc tracking bugs for this issue:

Affects: fedora-all [bug 2239187]

Comment 7 errata-xmlrpc 2024-02-13 14:43:02 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.14 for RHEL 8

Via RHSA-2024:0797 https://access.redhat.com/errata/RHSA-2024:0797