The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose data\/service members or instances list contain non-object entries (e.g. a bare integer) triggers the RapidJSON object-access precondition on the client, reading memory out of bounds and potentially crashing the bRPC client.<\/p>\n
Root Cause:
\nIn src\/brpc\/policy\/discovery_naming_service.cpp, DiscoveryNamingService::GetServers() and DiscoveryNames::ListDiscoveryNodes() access JSON values with member functions on non-object values. RapidJSON only defines these operations for object types; invoking them on a non-object violates the class invariant and results in undefined behavior (out-of-bounds read), commonly crashing the process.<\/p>\n
Affected Scenarios:
\nAn operator-configured (or compromised) Discovery backend returns a malformed \/discovery\/nodes or \/discovery\/fetchs response whose data\/service\/instance entries are not JSON objects, crashing any bRPC client that refreshes its server list.<\/p>\n
How to Fix:
\n1. Upgrade bRPC to version 1.18.0 or later, which fixes this issue.
\n2. Apply this patch: https:\/\/github.com\/apache\/brpc\/pull\/3533<\/p>\n
The fix validates that the Discovery response data, per-service data, and instance entries are JSON objects (and skips non-object node\/instance entries and rejects non-object data\/service values) before calling member accessors.<\/p>\n","protected":false},"excerpt":{"rendered":"
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-44085","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/44085","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=44085"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=44085"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=44085"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}