CVE-2022-24726: Unauthenticated control plane denial of service attack in Istio
A stack exhaustion flaw was found in the Istio control plane. This flaw allows a remote unauthenticated attacker to send a specially crafted or oversized message to crash the control plane process, resulting in a denial of service condition.
Other sources
Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing when the validating webhook for a cluster is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. This issue has been patched in versions 1.13.2, 1.12.5 and 1.11.8. Users are advised to upgrade. Users unable to upgrade should disable access to a validating webhook that is exposed to the public internet or restrict the set of IP addresses that can query it to a set of known, trusted entities.
The Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message, to crash the control plane process. This can be exploited when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from an attacker.
Security advisory: https://istio.io/latest/news/security/istio-security-2022-004.
Upstream commits/PRs: [master] https://github.com/istio/istio/commit/40f6caed64e6869a5589f2e2f38f1e64063fd930
[1.11] https://github.com/istio/istio/pull/37804 https://github.com/istio/istio/commit/458feb160756d6b38f1cee4ddb7a40ff50aaa713
[1.12] https://github.com/istio/istio/pull/37791 https://github.com/istio/istio/commit/e9c3781bd4097f94289b18ecb5a657438f47c9a4
[1.13] https://github.com/istio/istio/pull/37792 https://github.com/istio/istio/commit/6ca5055a4db6695ef5504eabdfde3799f2ea91fd
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this Istio flaw?
The vulnerability ID for this Istio flaw is CVE-2022-24726.
What is Istio?
Istio is an open platform to connect, manage, and secure microservices.
What is the severity level of CVE-2022-24726?
The severity level of CVE-2022-24726 is high with a CVSS score of 7.5.
How does CVE-2022-24726 affect Istio?
CVE-2022-24726 affects the Istio control plane, istiod, by causing a request processing error that can result in crashing of the control plane.
How can I fix CVE-2022-24726 in Istio?
To fix CVE-2022-24726 in Istio, you need to upgrade to version 1.11.8, 1.12.5, or 1.13.2 depending on your current version.