GitHub Advisoryadvisory · SwiftURL

GHSA-r6ww-5963-7r95 Denial of Service via reachable assertion

HIGH Published 2023-06-09 Modified 2024-02-09 Official page ↗
Aliases
CVE-2022-24777
Ecosystem
SwiftURL
Packages
github.com/grpc/grpc-swift
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-617
Reviewed
2023-06-09

Affected packages

• SwiftURL github.com/grpc/grpc-swift: < 1.7.2 → fixed in 1.7.2

Description

A grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This was due to incorrect logic when handling `GOAWAY` frames. The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will crash, dropping all in flight connections and requests. The issue was discovered by automated fuzz testing and is resolved by fixing the relevant state handling code.

Related

Alias · CVE (1)

  • CVE-2022-24777 grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. vulnerability

Weakness · CWE (1)

  • CWE-617 Reachable Assertion weakness

References