BIT-envoy-2024-32974: Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()

Published Jun 4, 2024

Updated

Envoy is a cloud-native, open source edge and service proxy. A crash was observed in EnvoyQuicServerStream::OnInitialHeadersComplete() with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after StopReading() being called on the stream. As after StopReading(), the HCM's ActiveStream might have already be destroyed and any up calls from QUICHE could potentially cause use after free.

Affected Software

1 affected component

Envoy Envoy

Event History

Jun 4, 2024

CVE Published

via OSV·09:00 PM

Data Sourced

via OSV·09:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to attempt exploitation?

The CVSS vector indicates the issue is reachable over the network and does not require attacker privileges or user interaction. Exploitation has high attack complexity.

What is the expected impact if exploitation succeeds?

The reported impact is limited to availability: a crash can cause high availability impact. No confidentiality or integrity impact is indicated.

BIT-envoy-2024-32974: Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to attempt exploitation?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to attempt exploitation?

What is the expected impact if exploitation succeeds?