GHSA-hww5-43gv-35jv: Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream

Published Jun 4, 2024

Updated

Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in HttpConnectionManager (HCM) with EnvoyQuicServerStream that can crash Envoy. An attacker can exploit this vulnerability by sending a request without FIN, then a RESETSTREAM frame, and then after receiving the response, closing the connection.

Affected Software

1 affected component

Envoy Envoy

Event History

Jun 4, 2024

CVE Published

via OSV·08:59 PM

Data Sourced

via OSV·08:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to trigger the crash?

An attacker needs network access to send a crafted request sequence to Envoy. No privileges or user interaction are required, but the attack has high complexity because it depends on sending a request without FIN, then a RESET_STREAM frame, receiving the response, and closing the connection.

What is the practical impact of successful exploitation?

Successful exploitation can crash Envoy, causing a denial of service. The provided information does not indicate confidentiality loss or integrity impact.

How can I tell whether an instance may be exposed?

An instance may be exposed if it uses Envoy's HttpConnectionManager with EnvoyQuicServerStream and accepts attacker-controlled connections capable of sending the specified stream and connection sequence. The provided data does not identify affected versions or a specific detection method.

GHSA-hww5-43gv-35jv: Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to trigger the crash?

What is the practical impact of successful exploitation?

How can I tell whether an instance may be exposed?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to trigger the crash?

What is the practical impact of successful exploitation?

How can I tell whether an instance may be exposed?