PT-2022-16872 · Unknown · Grpc Swift

Published 2022-03-25 · Updated 2023-06-09 · CVE-2022-24777

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions grpc-swift versions prior to 1.7.2

Description The issue is a denial of service attack via a reachable assertion, caused by incorrect logic when handling GOAWAY frames. This attack requires minimal resources to construct and send the required sequence of frames, resulting in a high impact on availability as the server will crash, dropping all in-flight connections and requests.

Recommendations For versions prior to 1.7.2, update to version 1.7.2 to resolve the issue. At the moment, there is no information about other workarounds for this issue.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2022-24777

GHSA-R6WW-5963-7R95

Affected Products

Grpc Swift

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24777.json · Exploit
• https://github.com/grpc/grpc-swift/commit/858f977f2a51fca2292f384cf7a108dc2e73a3bd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24777 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24777 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r6ww-5963-7r95 · Vendor Advisory
• https://github.com/grpc/grpc-swift/security/advisories/GHSA-r6ww-5963-7r95 · Note
• https://github.com/grpc/grpc-swift · Note
• https://t.me/cibsecurity/39544 · Telegram Post