REDHAT-BUG-2333091: Null Pointer Dereference
Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions sendOverloadError is going to assume the active request exists when envoy.loadshedpoints.http1serverabortdispatch is configured. If activerequest is nullptr, only onMessageBeginImpl() is called. However, the onMessageBeginImpl will directly return ok status if the stream is already reset leading to the nullptr reference. The downstream reset can actually happen during the H/2 upstream reset. As a result envoy may crash. This issue has been addressed in releases 1.32.3, 1.31.5, 1.30.9, and 1.29.12. Users are advised to upgrade. Users unable to upgrade may disable http1serverabortdispatch load shed point and/or use a high threshold.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2333091?
The severity of REDHAT-BUG-2333091 is considered high due to the potential for active request handling issues.
How do I fix REDHAT-BUG-2333091?
To fix REDHAT-BUG-2333091, you should upgrade Envoy to a version higher than 1.32.3.
Which versions of Envoy are affected by REDHAT-BUG-2333091?
Envoy versions from 1.29.12 up to, but not including, 1.32.3 are affected by REDHAT-BUG-2333091.
What components are primarily impacted by REDHAT-BUG-2333091?
The primary component impacted by REDHAT-BUG-2333091 is the sendOverloadError function within the Envoy Proxy.
What is the nature of the issue described in REDHAT-BUG-2333091?
The issue described in REDHAT-BUG-2333091 involves a flaw in request handling when the load shed points are misconfigured.