// For flags

CVE-2022-24777

Denial of Service via reachable assertion in grpc-swift

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will crash, dropping all in flight connections and requests. This issue is fixed in version 1.7.2. There are currently no known workarounds.

grpc-swift es la implementación en lenguaje Swift de gRPC, un framework de llamadas a procedimientos remotos (RPC). En versiones anteriores a 1.7.2, un servidor grpc-swift es vulnerable a un ataque de denegación de servicio por medio de una aserción alcanzable. Esto es debido a una lógica incorrecta cuando son manejadas las tramas GOAWAY. El ataque es de bajo esfuerzo: son necesarios muy pocos recursos para construir y enviar la secuencia de tramas requerida. El impacto en la disponibilidad es alto, ya que el servidor será bloqueado, dejando caer todas las conexiones y peticiones en vuelo. Este problema ha sido corregido en la versión 1.7.2. Actualmente no se presentan medidas de mitigación

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-10 CVE Reserved
  • 2022-03-25 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-10-29 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-617: Reachable Assertion
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linuxfoundation
Search vendor "Linuxfoundation"
 Grpc Swift
Search vendor "Linuxfoundation" for product "Grpc Swift"
 < 1.7.2
Search vendor "Linuxfoundation" for product "Grpc Swift" and version " < 1.7.2"
-
Affected