Envoy up to 1.29.8/1.30.5/1.31.1 Routing Table memory corruption

Summaryinfo

A vulnerability was found in Envoy up to 1.29.8/1.30.5/1.31.1. It has been declared as critical. The impacted element is an unknown function of the component Routing Table Handler. Such manipulation leads to memory corruption. This vulnerability is documented as CVE-2024-45809. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Envoy up to 1.29.8/1.30.5/1.31.1 and classified as critical. Affected by this issue is some unknown processing of the component Routing Table Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is availability. CVE summarizes:

Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clear_route_cache is enabled on the provider; 3. header operations are enabled in JWT filter, e.g. header to claims feature; 4. the routing table is configured in a way that the JWT header operations modify requests to not match any route. When these conditions are met, a crash is triggered in the upstream code due to nullptr reference conversion from route(). The root cause is the ordering of continueDecoding and clearRouteCache. This issue has been addressed in versions 1.31.2, 1.30.6, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The advisory is available at github.com. This vulnerability is handled as CVE-2024-45809 since 09/09/2024. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 210925 (Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-045)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.29.9, 1.30.6 or 1.31.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210925). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Envoy

Version

• 1.29.0
• 1.29.1
• 1.29.2
• 1.29.3
• 1.29.4
• 1.29.5
• 1.29.6
• 1.29.7
• 1.29.8
• 1.30.0
• 1.30.1
• 1.30.2
• 1.30.3
• 1.30.4
• 1.30.5
• 1.31.0
• 1.31.1

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion