Denial of Service via Data Amplification in Elixir gRPC

Executive Summary

This vulnerability is an improper handling of highly compressed data (data amplification) in the elixir-grpc grpc library, specifically in the GRPC.Compressor.Gzip and GRPC.Message modules. It allows a denial of service attack via a gzip decompression bomb.

The issue arises because the decompress/1 function calls :zlib.gunzip/1 directly on attacker-controlled compressed data without any limit on decompressed size, ratio checks, or incremental decoding. This means a small compressed payload can expand to multiple gigabytes in memory.

Since the max_receive_message_length limit is only checked after decompression, it does not prevent this attack. An unauthenticated remote attacker can send a single crafted frame with the grpc-encoding: gzip header to exhaust the server's memory and cause an out-of-memory crash.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial of service (DoS) condition by exhausting the memory of the BEAM node running the elixir-grpc grpc service.

An attacker can send a specially crafted compressed message that decompresses into a very large payload, causing the server to allocate excessive memory and potentially crash or become unresponsive.

Because the attack requires no authentication, it can be triggered remotely by any unauthenticated user, making systems using affected versions vulnerable to disruption.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an unauthenticated remote attacker sending a single crafted gRPC frame with the grpc-encoding: gzip header containing a highly compressed payload that decompresses to a very large size, causing denial of service by exhausting memory.

Detection can focus on monitoring incoming gRPC traffic for unusually small gzip-compressed payloads that decompress to very large sizes or cause resource exhaustion.

Specific commands are not provided in the resources, but general approaches include:

• Using network packet capture tools (e.g., tcpdump, Wireshark) to filter for gRPC traffic with grpc-encoding: gzip headers.
• Monitoring system logs and metrics for out-of-memory (OOM) events or BEAM node crashes.
• Implementing application-level logging to detect decompression failures or resource exhaustion errors related to gzip decompression.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability was fixed by implementing decompression size limits in the GRPC.Compressor.Gzip module.

Immediate mitigation steps include:

• Upgrade the elixir-grpc library to version 1.0.0 or later, where the vulnerability is patched.
• Apply the patch that enforces a maximum decompressed message size (default 4 MB) and processes input in chunks to detect decompression bombs early.
• Configure the maximum decompressed message size according to your environment to limit resource usage.
• Monitor your system for unusual memory usage or crashes until the patch is applied.

Useful 0 Not Useful 0