CVE-2023-1428 (published 2023-06-09T11:15Z)

There exists an vulnerability causing an abort() to be called in gRPC.\xa0\nThe following headers cause gRPC's C++ implementation to abort() when called via http2:\n\nte: x (x != trailers)\n\n:scheme: x (x != http, https)\n\ngrpclb_client_stats: x (x == anything)\n\nOn top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit\xa02485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.\n\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-617
cwe_name: Reachable Assertion
description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
extended_description: 
            While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service.
            For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.
         
         

Fix information:
repo_url: https://github.com/grpc/grpc
commit_details: repo_url: https://github.com/grpc/grpc
author: Craig Tiller
author_date: 2023-03-01 09:17:49-08:00
msg: [chttp2] Fix fuzzer found bug (#32507)

<!--

If you know who should review your pull request, please assign it to
that
person, otherwise the pull request would get assigned randomly.

If your pull request is for a specific language, please add the
appropriate
lang label.

-->
repository: repo_url: https://github.com/grpc/grpc
repo_name: grpc/grpc
description: The C based gRPC (C++, Python, Ruby, Objective-C, PHP, C#)
repo_language: C++
owner: grpc
file_changes: filename: hpack_parser.cc
change_type: ModificationType.MODIFY
diff: @@ -803,7 +803,7 @@ class HPackParser::Parser {
 
     template <typename Key, typename Value>
     void Encode(Key, const Value& value) {
-      AddToSummary(Key::key(), Key::Encode(value).size());
+      AddToSummary(Key::key(), EncodedSizeOfKey(Key(), value));
     }
 
    private:

programming_language: C++
filename: metadata_batch.cc
change_type: ModificationType.MODIFY
diff: @@ -168,6 +168,17 @@ StaticSlice HttpSchemeMetadata::Encode(ValueType x) {
   }
 }
 
+size_t EncodedSizeOfKey(HttpSchemeMetadata, HttpSchemeMetadata::ValueType x) {
+  switch (x) {
+    case HttpSchemeMetadata::kHttp:
+      return 4;
+    case HttpSchemeMetadata::kHttps:
+      return 5;
+    default:
+      return 0;
+  }
+}
+
 const char* HttpSchemeMetadata::DisplayValue(ValueType content_type) {
   switch (content_type) {
     case kHttp:

programming_language: C++
filename: metadata_batch.h
change_type: ModificationType.MODIFY
diff: @@ -49,6 +49,16 @@
 
 namespace grpc_core {
 
+// Given a metadata key and a value, return the encoded size.
+// Defaults to calling the key's Encode() method and then calculating the size
+// of that, but can be overridden for specific keys if there's a better way of
+// doing this.
+// May return 0 if the size is unknown/unknowable.
+template <typename Key>
+size_t EncodedSizeOfKey(Key, const typename Key::ValueType& value) {
+  return Key::Encode(value).size();
+}
+
 // grpc-timeout metadata trait.
 // ValueType is defined as Timestamp - an absolute timestamp (i.e. a
 // deadline!), that is converted to a duration by transports before being
@@ -90,6 +100,10 @@ struct TeMetadata {
   static const char* DisplayMemento(MementoType te) { return DisplayValue(te); }
 };
 
+inline size_t EncodedSizeOfKey(TeMetadata, TeMetadata::ValueType x) {
+  return x == TeMetadata::kTrailers ? 8 : 0;
+}
+
 // content-type metadata trait.
 struct ContentTypeMetadata {
   static constexpr bool kRepeatable = false;
@@ -140,6 +154,8 @@ struct HttpSchemeMetadata {
   }
 };
 
+size_t EncodedSizeOfKey(HttpSchemeMetadata, HttpSchemeMetadata::ValueType x);
+
 // method metadata trait.
 struct HttpMethodMetadata {
   static constexpr bool kRepeatable = false;
@@ -362,6 +378,11 @@ struct GrpcLbClientStatsMetadata {
   }
 };
 
+inline size_t EncodedSizeOfKey(GrpcLbClientStatsMetadata,
+                               GrpcLbClientStatsMetadata::ValueType) {
+  return 0;
+}
+
 // lb-token metadata
 struct LbTokenMetadata : public SimpleSliceBasedMetadata {
   static constexpr bool kRepeatable = false;

programming_language: C++
filename: clusterfuzz-testcase-minimized-hpack_parser_fuzzer-4859070937169920
change_type: ModificationType.ADD
diff: @@ -0,0 +1,4 @@
+frames {
+  max_metadata_length: 58
+  parse: "@\002te\000@\002te\002@\000et\000;e"
+}

programming_language: Batchfile