PT-2024-32670 · Tonic · Tonic

Luciofranco · Published 2024-10-01 · Updated 2024-10-30 · CVE-2024-47609

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green

Name of the Vulnerable Software and Affected Versions Tonic versions 0.12.0 through 0.12.2

Description The issue is a remote DoS attack that can cause the server to exit cleanly when using tonic::transport::Server and accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly, leading to the accept loop exiting.

Recommendations For versions 0.12.0 through 0.12.2, upgrade to tonic 0.12.3 or above to resolve the issue. As a temporary workaround for affected versions, consider implementing a custom accept loop to minimize the risk of exploitation.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2024-47609

GHSA-4JWC-W2HC-78QV

OPENSUSE-SU-2024:14440-1

RUSTSEC-2024-0376

Affected Products

Tonic

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47609.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-47609 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14440-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47609 · Security Note
• https://osv.dev/vulnerability/GHSA-4jwc-w2hc-78qv · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-47609 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47609 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2024-0376 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-47609 · Vendor Advisory
• https://github.com/hyperium/tonic/security/advisories/GHSA-4jwc-w2hc-78qv · Note
• https://github.com/hyperium/tonic · Note
• https://github.com/hyperium/tonic/commit/a4472a86f3290e60c7c01348b7e6a8164d6e7e48 · Note
• https://github.com/hyperium/tonic/issues/1897 · Note
• https://t.me/cvedetector/6792 · Telegram Post
• https://crates.io/crates/tonic · Note