BIT-envoy-2024-34362: Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream

Published Jun 4, 2024

Updated

Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in HttpConnectionManager (HCM) with EnvoyQuicServerStream that can crash Envoy. An attacker can exploit this vulnerability by sending a request without FIN, then a RESETSTREAM frame, and then after receiving the response, closing the connection.

Affected Software

1 affected component

Envoy Envoy

Event History

Jun 4, 2024

CVE Published

via OSV·08:59 PM

Data Sourced

via OSV·08:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to do to trigger the crash?

The attacker must be able to send a crafted request without a FIN, followed by a RESET_STREAM frame. After receiving the response, the attacker closes the connection, triggering the use-after-free condition and potentially crashing Envoy.

What is the practical impact of successful exploitation?

Successful exploitation can cause Envoy to crash, resulting in an availability impact. The provided information does not indicate confidentiality or integrity impact.

Which deployments are exposed?

The issue affects Envoy when HttpConnectionManager is used with EnvoyQuicServerStream. The provided data does not identify affected versions, fixed versions, or whether this configuration is enabled by default.

BIT-envoy-2024-34362: Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to do to trigger the crash?

What is the practical impact of successful exploitation?

Which deployments are exposed?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to do to trigger the crash?

What is the practical impact of successful exploitation?

Which deployments are exposed?