Istio up to 1.13.8/1.14.4/1.15.1 istiod resource consumption

Summaryinfo

A vulnerability has been found in Istio up to 1.13.8/1.14.4/1.15.1 and classified as problematic. This affects an unknown function of the component istiod. Performing a manipulation results in resource consumption. This vulnerability is identified as CVE-2022-39278. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Istio up to 1.13.8/1.14.4/1.15.1. This affects an unknown part of the component istiod. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.

The weakness was released 10/14/2022 as GHSA-86vr-4wcv-mm9w. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2022-39278 since 09/02/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 1.13.9, 1.14.5 or 1.15.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Istio

Version

• 1.13.0
• 1.13.1
• 1.13.2
• 1.13.3
• 1.13.4
• 1.13.5
• 1.13.6
• 1.13.7
• 1.13.8
• 1.14.0
• 1.14.1
• 1.14.2
• 1.14.3
• 1.14.4
• 1.15.0
• 1.15.1

Website

• Product: https://github.com/istio/istio/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion