High, CVSS 7.5GoPublished
otelgrpc DoS vulnerability due to unbound cardinality metrics
CVE-2023-47108 · GHSA-8pgv-569h-w5rw
- Affected
- Go go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc >= 0.37.0, < 0.46.0
- Fixed in
- 0.46.0· Vendor fix available
- Issue
- The grpc Unary Server Interceptor opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go out of the box adds labels - net.peer.sock.addr - net.peer.sock.port that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. Details An attacker can easily flood the peer address and port for requests. PoC Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it. Impact In order to be affected, the program has to configure a metrics pipeline, use UnaryServerInterceptor, and does not filter any client IP address and ports via middleware or proxies, etc. Others It is similar to already reported vulnerabilities. GHSA-rcjv-mgp8-qvmr (open-telemetry/opentelemetry-go-contrib) - GHSA-5r5m-65gx-7vrh (open-telemetry/opentelemetry-go-contrib) - GHSA-cg3q-j54f-5p7p…
Recommended action: Upgrade to 0.46.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.