Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Hyperium
  • Tonic

No data.

No data.

References
Link Providers
https://github.com/hyperium/tonic/commit/a4472a86f3290e60c7c01348b7e6a8164d6e7e48 cve-icon cve-icon cve-icon
https://github.com/hyperium/tonic/issues/1897 cve-icon cve-icon cve-icon
https://github.com/hyperium/tonic/security/advisories/GHSA-4jwc-w2hc-78qv cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-47609 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-47609 cve-icon
History

Wed, 02 Oct 2024 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Hyperium
Hyperium tonic
CPEs cpe:2.3:a:hyperium:tonic:*:*:*:*:*:*:*:*
Vendors & Products Hyperium
Hyperium tonic
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N'}

Wed, 02 Oct 2024 01:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

threat_severity

Low

Tue, 01 Oct 2024 20:30:00 +0000

Type Values Removed Values Added
Description Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.
Title Remotely exploitable DoS in Tonic `<=v0.12.2`
Weaknesses CWE-755
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/U:Green'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-10-01T20:13:55.017Z

Updated: 2024-10-02T13:16:31.606Z

Reserved: 2024-09-27T20:37:22.120Z

Link: CVE-2024-47609

cve-icon Vulnrichment

Updated: 2024-10-02T13:14:25.218Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-10-01T21:15:08.400

Modified: 2024-10-04T13:50:43.727

Link: CVE-2024-47609

cve-icon Redhat

Severity : Low

Publid Date: 2024-10-01T20:13:55Z

Links: CVE-2024-47609 - Bugzilla