CVE-2024-53270: HTTP/1: sending overload crashes when the request is reset beforehand in envoy
First published: Wed Dec 18 2024(Updated: )
Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to assume the active request exists when `envoy.load_shed_points.http1_server_abort_dispatch` is configured. If `active_request` is nullptr, only onMessageBeginImpl() is called. However, the `onMessageBeginImpl` will directly return ok status if the stream is already reset leading to the nullptr reference. The downstream reset can actually happen during the H/2 upstream reset. As a result envoy may crash. This issue has been addressed in releases 1.32.3, 1.31.5, 1.30.9, and 1.29.12. Users are advised to upgrade. Users unable to upgrade may disable `http1_server_abort_dispatch` load shed point and/or use a high threshold.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Envoy Proxy | >1.29.12<=1.32.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-53270?
CVE-2024-53270 is classified as a high-severity vulnerability due to its potential impact on service availability.
How does CVE-2024-53270 affect Envoy Proxy?
CVE-2024-53270 affects Envoy Proxy by causing an assumption that an active request exists when certain load shedding configurations are applied, which can lead to unexpected behavior.
Which versions of Envoy Proxy are affected by CVE-2024-53270?
CVE-2024-53270 affects Envoy Proxy versions between 1.29.12 and 1.32.3 (exclusive).
How do I fix CVE-2024-53270?
To fix CVE-2024-53270, upgrade Envoy Proxy to a version that is not within the affected range, specifically a version later than 1.32.3.
Is there a workaround for CVE-2024-53270?
Currently, there are no documented workarounds for CVE-2024-53270, and the best course of action is to update to a secure version.
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/type
- agent/author
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/trending
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-53270
- agent/severity
- agent/last-modified-date
- agent/source
- agent/references
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/envoy
- canonical/envoy proxy