CVE-2023-35945 Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec
Attackers can cause memory exhaustion and denial of service in Envoy by sending specific HTTP/2 frames, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-35945?
CVE-2023-35945 is a high-severity denial of service vulnerability in Envoyproxy Envoy, published on 13 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
Which versions are affected by CVE-2023-35945?
1 open source package ship an affected version, including envoy. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.23.11, 1.24.9, 1.25.8, 1.26.3 |
Linux distribution packages (28)
nghttp2 SUSE:Enterprise Storage 7.1 | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 1.40.0-150000.3.14.1 |
nghttp2 SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise Micro 5.1 | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise Micro 5.2 | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise Micro 5.3 | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise Micro 5.4 | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise Micro 5.5 | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.39.2-3.10.1 |
nghttp2 SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 1.40.0-150000.3.14.1 |
nghttp2 SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.39.2-3.10.1 |
nghttp2 SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 1.40.0-150000.3.14.1 |
nghttp2 SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.39.2-3.10.1 |
nghttp2 SUSE:Manager Proxy 4.2 | All versions | 1.40.0-150200.9.1 |
nghttp2 SUSE:Manager Server 4.2 | All versions | 1.40.0-150200.9.1 |
nghttp2 openSUSE:Leap 15.4 | All versions | 1.40.0-150200.9.1 |
nghttp2-python openSUSE:Leap 15.4 | All versions | 1.40.0-150200.9.1 |
nghttp2 openSUSE:Leap 15.5 | All versions | 1.40.0-150200.9.1 |
nghttp2-python openSUSE:Leap 15.5 | All versions | 1.40.0-150200.9.1 |
nghttp2 openSUSE:Tumbleweed | All versions | 1.55.1-1.1 |
Products include Envoyproxy Envoy, Nghttp2 Nghttp2.
How do I fix CVE-2023-35945?
Upgrade envoy to a fixed version for your release line: 1.23.11, 1.24.9, 1.25.8 or 1.26.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-35945 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-35945 exists.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as ALPINE-CVE-2023-35945, AZL-27650, AZL-27667, AZL-27682, AZL-27683, BIT-envoy-2023-35945 and 9 more.