CVE-2023-33953: gRPC HPACK Parser DoS Vulnerability

CVE-2023-33953 Overview

CVE-2023-33953 is a denial of service vulnerability in gRPC that stems from HPACK table accounting errors in the HTTP/2 header compression implementation. The vulnerability allows malicious clients to trigger unwanted disconnections between gRPC clients and servers through three distinct attack vectors targeting the HPACK parser.

Critical Impact

Remote attackers can cause unbounded memory consumption and CPU exhaustion in gRPC servers, leading to denial of service conditions without requiring authentication.

Affected Products

• gRPC (all vulnerable versions)
• Applications and services built on gRPC framework
• Google Cloud Platform services utilizing gRPC

Discovery Timeline

• 2023-08-09 - CVE-2023-33953 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-33953

Vulnerability Analysis

This vulnerability presents three distinct denial of service attack vectors targeting the HPACK parser implementation in gRPC. The most severe issue involves unbounded memory buffering where the header size limit check was positioned behind the string reading code, requiring the parser to buffer up to 4 gigabytes of string data before rejecting it as exceeding the 8 or 16KB limit.

The second vector exploits a quirk in HPACK varint encoding that permits an infinite number of leading zeros at the start of an integer. The gRPC HPACK parser was required to read all zeros before completing the parse operation, creating an opportunity for resource exhaustion.

The third vector leverages the metadata overflow check being performed per-frame rather than cumulatively. An attacker could chain HEADERS and CONTINUATION frames (e.g., HEADERS: containing a: 1, CONTINUATION: containing a: 2, etc.) to cause infinite buffering across frame boundaries.

Root Cause

The root cause is improper resource consumption controls (CWE-770) and uncontrolled memory allocation (CWE-789) in the gRPC HPACK parser. The implementation failed to properly bound memory allocation before validating input size constraints, and the per-input-block copy operation combined with the memory copy bug resulted in O(n²) parsing complexity where n is controlled by the attacker.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP/2 frames to a gRPC server. The attack leverages malformed HPACK-encoded headers that exploit the parser's failure to properly validate and limit resource consumption early in the parsing process.

The unbounded CPU consumption occurs due to a copy operation that happened per-input-block in the parser. Because this could be unbounded due to the memory copy bug, the result is an O(n²) parsing loop where the value of n is entirely selected by the malicious client.

Detection Methods for CVE-2023-33953

Indicators of Compromise

• Unusual memory growth patterns in gRPC server processes
• Abnormally large HTTP/2 HEADERS or CONTINUATION frame sequences
• gRPC server processes consuming excessive CPU during header parsing
• Unexpected client-server disconnections without application-level errors

Detection Strategies

• Monitor gRPC server memory utilization for sudden spikes during request processing
• Implement network-level inspection for HTTP/2 frame sequences with anomalous CONTINUATION frame counts
• Set up alerting for gRPC server CPU utilization anomalies correlated with incoming traffic patterns
• Deploy application performance monitoring to detect parsing latency increases

Monitoring Recommendations

• Enable detailed gRPC server logging to capture frame-level processing metrics
• Configure resource utilization thresholds for gRPC server processes with automated alerting
• Implement connection rate limiting at the load balancer level to mitigate amplification
• Use SentinelOne's Singularity Platform to monitor for resource exhaustion patterns indicative of DoS attacks

How to Mitigate CVE-2023-33953

Immediate Actions Required

• Upgrade gRPC to the latest patched version addressing this vulnerability
• Review and update all applications and microservices using gRPC dependencies
• Implement request size limits at the network perimeter to reduce attack surface
• Enable rate limiting on gRPC endpoints to mitigate exploitation attempts

Patch Information

Google has released security updates to address this vulnerability. Refer to the Google Cloud Security Bulletin GCP-2023-022 for detailed patch information and affected version ranges. Organizations should prioritize updating gRPC libraries across all affected systems and verify that downstream dependencies have also been patched.

Workarounds

• Deploy a reverse proxy or load balancer with HTTP/2 frame inspection capabilities to filter malicious requests
• Configure connection timeouts and memory limits for gRPC server processes to limit impact
• Implement network-level rate limiting to reduce the effectiveness of DoS attempts
• Consider temporarily restricting access to gRPC endpoints from untrusted networks until patches are applied

# Example: Configure gRPC server resource limits (implementation-specific)
# Set maximum header list size to prevent unbounded buffering
export GRPC_ARG_MAX_METADATA_SIZE=8192
# Configure maximum receive message length
export GRPC_ARG_MAX_RECEIVE_MESSAGE_LENGTH=4194304