CVE-2024-23322 Envoy crashes when idle and request per try timeout occur within the backoff interval
Attackers can crash the Envoy proxy by triggering specific timeout conditions, requiring non-default configuration settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23322?
CVE-2024-23322 is a high-severity use after free vulnerability in Envoyproxy Envoy, published on 9 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is enabled, 2. per_try_idle_timeout is enabled (it can only be done in configuration), 3. per-try-timeout is enabled, either through headers or configuration and its value is equal, or within the backoff interval of the per_try_idle_timeout. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-416
Which versions are affected by CVE-2024-23322?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | From 1.26.0 | 1.26.7, 1.27.3, 1.28.1, 1.29.1 |
Products include Envoyproxy Envoy.
How do I fix CVE-2024-23322?
Upgrade envoy to a fixed version for your release line: 1.26.7, 1.27.3, 1.28.1 or 1.29.1.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-23322 being exploited?
There is no known exploitation of CVE-2024-23322 in the wild and no public exploit code.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2024-23322, GHSA-6p83-mfmh-qv38.