Envoy up to 1.27.5/1.28.3/1.29.4/11.30.1 OnInitialHeadersComplete use after free

Summaryinfo

A vulnerability was found in Envoy up to 1.27.5/1.28.3/1.29.4/11.30.1. It has been rated as critical. Affected by this vulnerability is the function EnvoyQuicServerStream::OnInitialHeadersComplete. The manipulation leads to use after free. This vulnerability is listed as CVE-2024-32974. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Envoy up to 1.27.5/1.28.3/1.29.4/11.30.1. This issue affects the function EnvoyQuicServerStream::OnInitialHeadersComplete. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is availability. The summary by CVE is:

Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the stream. As after `StopReading()`, the HCM's `ActiveStream` might have already be destroyed and any up calls from QUICHE could potentially cause use after free.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-32974 since 04/22/2024. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/12/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Envoy

Version

• 1.27.0
• 1.27.1
• 1.27.2
• 1.27.3
• 1.27.4
• 1.27.5
• 1.28.0
• 1.28.1
• 1.28.2
• 1.28.3
• 1.29.0
• 1.29.1
• 1.29.2
• 1.29.3
• 1.29.4
• 11.30.0
• 11.30.1

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion