CVE-2024-53270 HTTP/1: sending overload crashes when the request is reset beforehand in envoy
A null pointer dereference in Envoy proxy causes a crash when handling overloaded HTTP/1 requests that are reset prematurely, requiring specific load shedding configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53270?
CVE-2024-53270 is a high-severity vulnerability in Envoyproxy Envoy, published on 18 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to assume the active request exists when `envoy.load_shed_points.http1_server_abort_dispatch` is configured. If `active_request` is nullptr, only onMessageBeginImpl() is called. However, the `onMessageBeginImpl` will directly return ok status if the stream is already reset leading to the nullptr reference. The downstream reset can actually happen during the H/2 upstream reset. As a result envoy may crash. This issue has been addressed in releases 1.32.3, 1.31.5, 1.30.9, and 1.29.12. Users are advised to upgrade. Users unable to upgrade may disable `http1_server_abort_dispatch` load shed point and/or use a high threshold.
Which versions are affected by CVE-2024-53270?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.29.12, 1.30.9, 1.31.5, 1.32.3 |
Products include Envoyproxy Envoy.
How do I fix CVE-2024-53270?
Upgrade envoy to a fixed version for your release line: 1.29.12, 1.30.9, 1.31.5 or 1.32.3.
Is CVE-2024-53270 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53270 exists.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2024-53270, GHSA-q9qv-8j52-77p3.