Cloudanix VulnDB

CVE-2024-47609

None

CVSS

—

EPSS

0.6%

Published

Oct 1, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in certain gRPC server software lets anyone on the network send a special connection that makes the server stop working until someone restarts it.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Uncaught errors from TCP/TLS accept calls in tonic::transport::Server cause the accept loop to terminate and the server process to exit cleanly, resulting in immediate denial of service.

Why it matters to the business

gRPC-based services become unavailable until the server is restarted, interrupting dependent applications and potentially causing outages in environments that rely on tonic or Graylog.

How an attack unfolds

An attacker establishes a TCP or TLS connection that triggers an accept error not handled by the server loop; the uncaught error propagates and cleanly terminates the process, requiring manual restart. No authentication or special privileges are needed.

How to fix it

Upgrade hyperium/tonic to commit 4b8d2c46aa57e40b1e80077f4f7b7d4679027bb5 or later (tonic 0.12.3+). For Graylog deployments upgrade org.graylog2:graylog2-server to 5.1.3 or later. Restart affected services after upgrade and verify the accept error paths are now handled.

How to confirm the fix worked

Confirm the running tonic or Graylog version matches a fixed release. Attempt to reproduce the original error condition in a test environment and verify the server remains running instead of exiting.

Typical attack path

  1. Attacker connects to the exposed tonic or Graylog gRPC port
  2. Sends a stream that forces the accept call to return an unhandled error condition
  3. Server accept loop exits and the process terminates
  4. Service remains down until restart or automatic recovery

How to detect it

Monitor application and system logs for unexpected tonic or Graylog server process exits immediately after TCP/TLS accept events. Correlate with connection attempts that precede abrupt shutdowns without normal termination messages.

What your security team should do

  • Apply the listed fixed versions immediately on all exposed tonic and Graylog instances
  • Restrict gRPC listener exposure to trusted networks until patched
  • Add process monitoring and automatic restart for gRPC servers
  • Review downstream dependents of tonic for additional upgrade needs

The record

Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.

Affected packages

Ecosystem Package Introduced Fixed
crates.io tonic 0.12.2 0.12.3
Chainguard atuin 0 18.4.0-r1
Chainguard buck2 0 20250301-r0
Chainguard linkerd2-proxy 0 2.328.0-r0
Chainguard parseable 0 1.7.5-r0
Chainguard qdrant 0 1.13.5-r0
Chainguard qdrant-oci-compat 0 1.13.5-r0
Chainguard qdrant-oci-entrypoint 0 1.13.5-r0
Chainguard wadm 0 0.21.0-r4
Chainguard wash 0 0.39.0-r1
Ubuntu:24.10 rust-tonic 0 No fix
Ubuntu:25.04 rust-tonic 0 No fix
Ubuntu:25.10 rust-tonic 0 No fix
Wolfi atuin 0 18.4.0-r1
Wolfi buck2 0 20250301-r0
Wolfi linkerd2-proxy 0 2.328.0-r0
Wolfi parseable 0 1.7.5-r0
Wolfi qdrant 0 1.13.5-r0
Wolfi qdrant-oci-compat 0 1.13.5-r0
Wolfi qdrant-oci-entrypoint 0 1.13.5-r0
Wolfi wadm 0 0.21.0-r4
Wolfi wash 0 0.39.0-r1
cargo tonic 0.12.0 0.12.3
cargo tonic 0.12.2 No fix
cargo tonic 0.12.2 0.12.3
openSUSE:Tumbleweed cargo-audit-advisory-db 0 20241030-1.1

Related vulnerabilities