CVE-2022-3171: Google Protobuf DoS Vulnerability

CVE-2022-3171 Overview

CVE-2022-3171 is a Denial of Service vulnerability affecting Google Protocol Buffers (protobuf) implementations across Java, Kotlin, and Ruby platforms. The vulnerability stems from improper input validation during the parsing of binary data, where crafted inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields can cause excessive garbage collection activity, resulting in service degradation or complete denial of service.

Protocol Buffers is Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data, widely used in gRPC, microservices architectures, and data interchange scenarios. This vulnerability's network-accessible attack vector and lack of required privileges make it particularly concerning for internet-facing services.

Critical Impact

Attackers can remotely trigger prolonged garbage collection pauses in applications parsing protobuf messages, causing service unavailability without authentication.

Affected Products

• Google protobuf-java (versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3)
• Google protobuf-javalite (versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3)
• Google protobuf-kotlin (versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3)
• Google protobuf-kotlin-lite (versions prior to 3.21.7, 3.20.3, 3.19.6, and 3.16.3)
• Google google-protobuf (Ruby gem, affected versions)
• Fedora 37 (bundled protobuf packages)

Discovery Timeline

• 2022-10-12 - CVE-2022-3171 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-3171

Vulnerability Analysis

This vulnerability is classified under CWE-20 (Improper Input Validation). The flaw exists in how protobuf-java core and lite libraries handle the parsing of specially crafted binary protocol buffer messages. When a message contains multiple instances of non-repeated embedded messages combined with repeated or unknown fields, the parser enters a pathological state where internal objects are repeatedly converted between mutable and immutable representations.

This back-and-forth conversion generates excessive temporary objects that accumulate in the JVM heap, triggering frequent and potentially prolonged garbage collection (GC) cycles. The attack is particularly effective because it exploits fundamental memory management behavior rather than traditional buffer overflows or code execution paths.

Root Cause

The root cause lies in the message parsing logic's handling of embedded message fields. When the parser encounters non-repeated embedded messages with repeated or unknown fields across multiple instances, it fails to maintain a consistent object state. Instead, the implementation oscillates between mutable builder objects and immutable message objects during the parse operation.

This design flaw causes memory churn as each conversion cycle allocates new objects while the previous objects await garbage collection. The cumulative effect of processing a malicious payload can overwhelm the garbage collector, causing stop-the-world GC pauses that effectively halt application processing.

Attack Vector

The attack can be executed remotely over the network without any authentication or user interaction. An attacker crafts a malicious protocol buffer binary message and sends it to any endpoint that parses protobuf messages using vulnerable library versions. Services using gRPC, custom protobuf-based APIs, or any application deserializing untrusted protobuf data are potential targets.

The attack payload would consist of a carefully constructed binary message with nested embedded message structures designed to maximize the mutable-immutable conversion cycles during parsing. Since protocol buffers are designed to be compact and efficient, relatively small payloads can trigger significant resource exhaustion.

Detection Methods for CVE-2022-3171

Indicators of Compromise

• Unusual spikes in JVM garbage collection activity, particularly full GC events
• Increased GC pause times correlating with incoming protobuf message processing
• Memory pressure alerts on services processing protobuf data
• Application response time degradation coinciding with message parsing operations
• Heap memory usage patterns showing rapid allocation and deallocation cycles

Detection Strategies

• Monitor JVM GC logs for anomalous pause duration and frequency patterns
• Implement application performance monitoring (APM) to track protobuf parsing latency
• Configure alerts for heap memory utilization exceeding baseline thresholds during message processing
• Use Software Composition Analysis (SCA) tools to identify vulnerable protobuf library versions in your dependency tree
• Deploy network traffic analysis to identify unusually structured protobuf payloads

Monitoring Recommendations

• Enable detailed GC logging (-Xlog:gc* for JDK 9+) on services processing protobuf messages
• Set up SentinelOne Singularity to monitor for resource exhaustion patterns indicative of DoS attempts
• Implement request rate limiting and payload size validation at ingress points
• Configure health checks that include GC metrics to detect degraded service states

How to Mitigate CVE-2022-3171

Immediate Actions Required

• Update protobuf-java to version 3.21.7, 3.20.3, 3.19.6, or 3.16.3 or later depending on your version branch
• Update protobuf-javalite, protobuf-kotlin, and protobuf-kotlin-lite to corresponding patched versions
• For Ruby applications, update the google-protobuf gem to patched versions
• Audit all transitive dependencies that may bundle vulnerable protobuf versions
• Apply Fedora security updates if running Fedora 37

Patch Information

Google has released patched versions addressing this vulnerability across multiple release branches to accommodate different upgrade paths. The GitHub Security Advisory provides comprehensive details on fixed versions and upgrade guidance.

For Fedora users, security updates are available through the standard package management system as documented in the Fedora Package Announcements. Gentoo users should refer to GLSA-202301-09 for distribution-specific guidance.

Workarounds

• Implement input validation to reject protobuf messages exceeding reasonable size limits before parsing
• Deploy request rate limiting to reduce the impact of potential exploitation attempts
• Configure JVM heap size limits and GC tuning to contain the blast radius of memory exhaustion
• Use network-level controls to restrict protobuf endpoint access to trusted sources where feasible
• Consider implementing parsing timeouts to abort processing of pathologically slow messages

# Maven dependency update example
# Update pom.xml to use patched protobuf-java version
mvn versions:use-dep-version -Dincludes=com.google.protobuf:protobuf-java -DdepVersion=3.21.7

# Verify updated dependency
mvn dependency:tree | grep protobuf