envoyproxy envoy up to 1.26.7/1.27.3/1.28.1/1.29.1 Timeout use after free

Summaryinfo

A vulnerability was found in envoyproxy envoy up to 1.26.7/1.27.3/1.28.1/1.29.1 and classified as problematic. The impacted element is an unknown function of the component Timeout Handler. Executing a manipulation can lead to use after free. This vulnerability appears as CVE-2024-23322. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in envoyproxy envoy up to 1.26.7/1.27.3/1.28.1/1.29.1 (Firewall Software). It has been declared as problematic. This vulnerability affects an unknown code of the component Timeout Handler. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect availability. CVE summarizes:

Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is enabled, 2. per_try_idle_timeout is enabled (it can only be done in configuration), 3. per-try-timeout is enabled, either through headers or configuration and its value is equal, or within the backoff interval of the per_try_idle_timeout. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was presented 02/10/2024 as GHSA-6p83-mfmh-qv38. The advisory is shared for download at github.com. This vulnerability was named CVE-2024-23322 since 01/15/2024. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.26.7, 1.27.3, 1.28.1 or 1.29.1 eliminates this vulnerability. Applying the patch 843f9e6a123ed47ce139b421c14e7126f2ac685e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• envoyproxy

Name

• envoy

Version

• 1.26.0
• 1.26.1
• 1.26.2
• 1.26.3
• 1.26.4
• 1.26.5
• 1.26.6
• 1.26.7
• 1.27.0
• 1.27.1
• 1.27.2
• 1.27.3
• 1.28.0
• 1.28.1
• 1.29.0
• 1.29.1

License

• free

Website

• Product: https://github.com/envoyproxy/envoy/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion