CVE-2022-29224: Segmentation fault leading to crash in Envoy
First published: Fri May 20 2022(Updated: )
Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy also has a feature which can “hold� (prevent removal) upstream hosts obtained via service discovery until configured active health checking fails. If an attacker controls an upstream host and also controls service discovery of that host (via DNS, the EDS API, etc.), an attacker can crash Envoy by forcing removal of the host from service discovery, and then failing the gRPC health check request. This will crash Envoy via a null pointer dereference. Users are advised to upgrade to resolve this vulnerability. Users unable to upgrade may disable gRPC health checking and/or replace it with a different health checking type as a mitigation.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Envoyproxy Envoy | <1.22.1 | |
| redhat/servicemesh-proxy | <0:2.0.10-1.el8 | 0:2.0.10-1.el8 |
| redhat/servicemesh-proxy | <0:2.1.3-1.el8 | 0:2.1.3-1.el8 |
Remedy
Disable gRPC health checking and/or replace it with a different health checking type.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/envoyproxy/envoy/commit/9b1c3962172a972bc0359398af6daa3790bb59db
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-m4j9-86g3-8f49
- https://access.redhat.com/errata/RHSA-2022:5003
- https://access.redhat.com/errata/RHSA-2022:5004
- https://access.redhat.com/security/cve/cve-2022-29224
- https://bugzilla.redhat.com/show_bug.cgi?id=2088738
- https://www.cve.org/CVERecord?id=CVE-2022-29224 https://nvd.nist.gov/vuln/detail/CVE-2022-29224 https://github.com/envoyproxy/envoy/security/advisories/GHSA-m4j9-86g3-8f49
Frequently Asked Questions
What is CVE-2022-29224?
CVE-2022-29224 is a vulnerability in Envoy that allows an attacker to cause a segmentation fault in the GrpcHealthCheckerImpl.
What is the severity of CVE-2022-29224?
CVE-2022-29224 has a severity value of 5.9, which is considered medium.
What software versions are affected by CVE-2022-29224?
Versions of Envoy prior to 1.22.1 are affected by CVE-2022-29224.
How can I fix CVE-2022-29224?
To fix CVE-2022-29224, update Envoy to version 1.22.1 or later.
What is the Common Weakness Enumeration (CWE) ID for CVE-2022-29224?
The CWE ID for CVE-2022-29224 is 476.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/author
- agent/references
- agent/severity
- agent/remedy
- agent/weakness
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-29224
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/tags
- agent/event
- package-manager/redhat
- vendor/envoyproxy
- canonical/envoyproxy envoy