The grpc Unary Server Interceptor opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go
// UnaryServerInterceptor returns a grpc.UnaryServerInterceptor suitable
// for use in a grpc.NewServer call.
func UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor {
out of the box adds labels
net.peer.sock.addrnet.peer.sock.portthat have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent.
An attacker can easily flood the peer address and port for requests.
Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it.
In order to be affected, the program has to configure a metrics pipeline, use UnaryServerInterceptor, and does not filter any client IP address and ports via middleware or proxies, etc.
It is similar to already reported vulnerabilities.
As a workaround to stop being affected, a view removing the attributes can be used.
The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.
In PR #4322, to be released with v0.46.0, the attributes were removed.
| Score | Percentile |
|---|---|
| 4.30% | 88.50% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 7.5 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-8pgv-569h-w5rw ↗ |
| CVE | CVE-2023-47108 ↗ |
| CWE id | Name |
|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| go | go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc | >= 0.37.0, < 0.46.0 | 0.46.0 | — |