CVE-2024-11407
📋 TL;DR
This CVE describes a data corruption vulnerability in gRPC-C++ servers when transmit zero copy is enabled. The corruption occurs before network transmission, causing RPC requests to fail with incorrect data. This affects any gRPC-C++ server using the GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED channel argument.
💻 Affected Systems
- gRPC-C++
📦 What is this software?
Grpc by Grpc
⚠️ Risk & Real-World Impact
Worst Case
Critical RPC failures leading to complete service disruption, data integrity issues, and potential cascading failures in distributed systems.
Likely Case
Intermittent RPC failures causing degraded service performance, application errors, and potential data corruption in transmitted payloads.
If Mitigated
Minimal impact if zero copy is disabled or systems are patched, with only performance degradation from disabling the optimization.
🎯 Exploit Status
Exploitation requires sending RPC requests to vulnerable servers; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 or later
Vendor Advisory: https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791
Restart Required: Yes
Instructions:
1. Update gRPC-C++ to commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 or later. 2. Rebuild and redeploy affected applications. 3. Restart gRPC servers.
🔧 Temporary Workarounds
Disable TCP Zero Copy
allDisable the vulnerable feature by removing GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED from channel arguments.
Set GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED to 0 or false in channel configuration
🧯 If You Can't Patch
- Disable GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED in all channel configurations
- Implement application-level data validation and error handling for RPC failures
🔍 How to Verify
Check if Vulnerable:
Check if GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED is enabled in channel arguments and gRPC version is before commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791.Check Version:
Check gRPC version in build configuration or via package manager (e.g., 'apt show libgrpc++' or equivalent).Verify Fix Applied:
Verify gRPC version includes commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 and test RPC functionality with zero copy enabled.📡 Detection & Monitoring
Log Indicators:
- Increased RPC failure rates
- Data corruption errors in gRPC logs
- Unexpected RPC timeouts
Network Indicators:
- Abnormal RPC response patterns
- Inconsistent payload sizes
SIEM Query:
Search for gRPC error codes related to data corruption or transmission failures.