CVE-2024-11407

What it actually does

gRPC-C++ servers with GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED enabled can corrupt application data before network transmission, resulting in the receiver obtaining an incorrect byte stream and RPC failures.

Why it matters to the business

Systems relying on gRPC for inter-service communication may experience unexpected request failures and service unavailability until the library is updated, increasing operational overhead in high-volume environments.

How an attack unfolds

An attacker or misbehaving client triggers the flaw simply by interacting with a vulnerable server that has zero-copy transmit enabled; data corruption occurs during normal transmission, causing the receiving side to reject or mishandle the RPC without any special payload required.

How to fix it

Upgrade grpc/grpc to commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 or later; if immediate upgrade is not feasible, disable GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED on affected channels.

How to confirm the fix worked

Confirm the running binary or build includes commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791; test by exercising RPC traffic with the channel argument enabled and verifying absence of corruption-induced failures.

Typical attack path

1. Identify or deploy a gRPC-C++ server with GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED set on the channel
2. Initiate standard RPC calls that exercise the transmit path
3. Observe data corruption at the receiver leading to RPC failure or timeout

How to detect it

Review application and gRPC logs for unexpected RPC failures or data-integrity errors on servers using the zero-copy transmit option; search configuration files and command lines for the GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED channel argument.

• GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED
• data corruption
• incorrect set of bytes

What your security team should do

• Apply the fixed commit immediately in all gRPC-C++ server deployments
• Audit configurations for use of GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED and disable where possible until patched
• Monitor EPSS and KEV updates for any future increase in exploit activity