CVE-2024-11407: gRPC-C++ Data Corruption DoS Vulnerability

CVE-2024-11407 Overview

CVE-2024-11407 is a data corruption vulnerability in gRPC-C++ servers that have transmit zero-copy enabled through the GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED channel argument. The flaw resides in the POSIX endpoint implementation of the EventEngine subsystem. Application data may be corrupted before transmission over the network, causing receivers to observe incorrect byte sequences and triggering RPC request failures. This condition results in a denial of service against services relying on gRPC-C++ for inter-process or inter-service communication. The gRPC project addressed the issue in commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791.

Critical Impact
Servers using zero-copy transmit may send corrupted bytes on the wire, breaking RPC integrity and forcing repeated request failures across dependent services.

Affected Products

gRPC-C++ (grpc/grpc) versions prior to commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791
Deployments enabling the channel argument GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED
Services relying on the POSIX EventEngine endpoint in gRPC-C++

Discovery Timeline

2024-11-26 - CVE CVE-2024-11407 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11407

Vulnerability Analysis

The vulnerability lives in src/core/lib/event_engine/posix_engine/posix_endpoint.cc in the transmit zero-copy (Tx0cp) code path. When gRPC-C++ builds the iovec array for a zero-copy send, it fails to advance the base pointer of a partially consumed slice. As a result, the kernel reads bytes from the start of the slice while the length field reflects the remaining portion. The receiver observes a shifted, incorrect byte stream, and the RPC framing fails. CWE-682 (Incorrect Calculation) captures the arithmetic error at the root of the bug.

Root Cause

The defect is an offset miscalculation in the iovec construction loop. The code assigned iov[iov_size].iov_base = slice.begin() without adding out_offset_.byte_idx, even though iov_len was correctly computed as slice.length() - out_offset_.byte_idx. When a send operation resumed from a non-zero byte offset within a slice, the pointer and length disagreed on where the payload started.

Attack Vector

Exploitation requires an attacker-influenced workload against a gRPC-C++ server with zero-copy transmit enabled and conditions that cause partial slice sends. The attacker does not need to inject packets or authenticate to a privileged interface; triggering RPC patterns that induce partial writes is sufficient to corrupt subsequent transmissions. The impact is limited to availability: RPC failures propagate to callers and can cascade through dependent microservices.

text

        iov_size++) {
     MutableSlice& slice = internal::SliceCast<MutableSlice>(
         buf_.MutableSliceAt(out_offset_.slice_idx));
-    iov[iov_size].iov_base = slice.begin();
+    iov[iov_size].iov_base = slice.begin() + out_offset_.byte_idx;
     iov[iov_size].iov_len = slice.length() - out_offset_.byte_idx;
     *sending_length += iov[iov_size].iov_len;
     ++(out_offset_.slice_idx);

Source: gRPC commit e9046b2 — the patch adds the missing out_offset_.byte_idx offset so iov_base and iov_len describe the same slice region.

Detection Methods for CVE-2024-11407

Indicators of Compromise

Elevated rates of gRPC status codes such as INTERNAL, DATA_LOSS, or framing errors reported by clients connecting to gRPC-C++ servers.
HTTP/2 stream resets and connection tear-downs on gRPC listeners after enabling zero-copy transmit.
Server logs from gRPC-C++ processes referencing posix_endpoint.cc write paths with truncated or misaligned buffers.

Detection Strategies

Inventory gRPC-C++ services and enumerate any that set GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED in channel arguments or environment variables.
Correlate application-layer RPC failure spikes with the introduction of zero-copy transmit configuration to distinguish this bug from network faults.
Compare the gRPC commit hash of deployed binaries against the fix commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791.

Monitoring Recommendations

Track per-service RPC error rates and latency distributions to detect abrupt regressions after gRPC-C++ upgrades or configuration changes.
Emit metrics on TCP send-side counters and short writes to identify the partial-slice scenarios that trigger the flaw.
Ingest gRPC server logs into a centralized SIEM and alert on repeated stream-level protocol errors from the same endpoint.

How to Mitigate CVE-2024-11407

Immediate Actions Required

Upgrade gRPC-C++ to a build that includes commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 or later.
Audit all channel argument configurations for GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED and validate whether zero-copy is required for the workload.
Rebuild and redeploy any downstream binaries that statically link the vulnerable gRPC-C++ library.

Patch Information

The fix is available in gRPC upstream commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791. The patch corrects the iov_base calculation in src/core/lib/event_engine/posix_engine/posix_endpoint.cc so that partial slice transmissions start from the correct byte offset. Consumers should upgrade to a released gRPC-C++ version that includes this commit.

Workarounds

Disable transmit zero-copy by removing or setting GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED to 0 in server channel arguments until the patched build is deployed.
Restrict use of the affected servers to internal, trusted networks while patching is in progress to reduce blast radius from RPC failures.

bash

# Disable zero-copy transmit as a temporary mitigation (C++ channel args)
# grpc::ChannelArguments args;
# args.SetInt(GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED, 0);

# Verify the deployed gRPC commit includes the fix
git -C /path/to/grpc log --oneline | grep e9046b2bbebc0cb7f5dc42008f807f6c7e98e791