CVE-2024-23322: Envoy crashes when idle and request per try timeout occur within the backoff interval
Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedgeonpertrytimeout is enabled, 2. pertryidletimeout is enabled (it can only be done in configuration), 3. per-try-timeout is enabled, either through headers or configuration and its value is equal, or within the backoff interval of the pertryidletimeout. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.29.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.28.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.27.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.26.7
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23322?
CVE-2024-23322 is classified as a critical vulnerability due to the potential crash of Envoy proxy under specific conditions.
How do I fix CVE-2024-23322?
To fix CVE-2024-23322, upgrade to a version of Envoy that is greater than 1.29.1, 1.28.1, 1.27.3, or 1.26.7.
What versions of Envoy are affected by CVE-2024-23322?
CVE-2024-23322 affects Envoy versions from 1.26.0 to 1.26.7, from 1.27.0 to 1.27.3, from 1.28.0 to 1.28.1, and from 1.29.0 to 1.29.1.
What triggers the crash in CVE-2024-23322?
The crash is triggered when both hedge_on_per_try_timeout and per_try_idle_timeout are enabled within the same time interval in Envoy's configuration.
Is there a workaround for CVE-2024-23322?
A potential workaround for CVE-2024-23322 is to disable either hedge_on_per_try_timeout or per_try_idle_timeout to avoid the crash condition.