CVE-2022-29227: Use after free in Envoy
First published: Thu Jun 09 2022(Updated: )
Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, there’s a lifetime bug which can be triggered. If while replaying the request Envoy sends a local reply when the redirect headers are processed, the downstream state indicates that the downstream stream is not complete. On sending the local reply, Envoy will attempt to reset the upstream stream, but as it is actually complete, and deleted, this result in a use-after-free. Users are advised to upgrade. Users unable to upgrade are advised to disable internal redirects if crashes are observed.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Envoyproxy Envoy | <1.22.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Envoy vulnerability?
The vulnerability ID for this Envoy vulnerability is CVE-2022-29227.
What is the affected software for this vulnerability?
The affected software for this vulnerability is Envoy versions prior to 1.22.1.
What is the severity of CVE-2022-29227?
The severity of CVE-2022-29227 is high with a CVSS score of 7.5.
How can this vulnerability be triggered?
This vulnerability can be triggered if Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers.
Are there any references for this vulnerability?
Yes, you can find references for this vulnerability at the following links: [GitHub Commit](https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab) and [GitHub Security Advisory](https://github.com/envoyproxy/envoy/security/advisories/GHSA-rm2p-qvf6-pvr6).
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/title
- agent/severity
- agent/author
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/envoyproxy
- canonical/envoyproxy envoy