CVE-2023-47108

A memory exhaustion flaw was found in the otelgrpc handler of open-telemetry. This flaw may allow a remote unauthenticated attacker to flood the peer address and port and exhaust the server's memory by sending multiple malicious requests, affecting the availability of the system.

While no authentication is required, there are a significant number of non-default factors that prevent widespread exploitation of this issue. To affect a service, all of the following must be true:

• The go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc package must be in use
• Configured a metrics pipeline that uses the UnaryServerInterceptor wrapper function
• No filtering of unknown HTTP methods or user agents at a higher level, such as Content Delivery Network

Due to the limited attack surface, Red Hat Product Security rates the impact of this flaw as Moderate.

cluster-network-operator-container in Openshift Container Platform 4 is rated as low and Won't Fix as the stats are behind an RBAC proxy and isn't available to unauthenticated users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.