CVE-2024-23322 — Use After Free in Envoy

CWE-416 — Use After Free2 documents2 sources

Severity

7.5HIGHNVD

EPSS

0.1%

top 75.22%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Envoyproxy Envoy

Timeline

PublishedFeb 9

Description

Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is enabled, 2. per_try_idle_timeout is enabled (it can only be done in configuration), 3. per-try-timeout is enabled, either through headers or configuration and its value is equal, or within the backoff interval of the per_try_idle_timeout. This issue has been addressed in released 1.29.1, 1.28.1,…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5envoyproxy/envoy< 1.26.7+3

▶NVDenvoyproxy/envoy1.26.0 — 1.26.7+3

Patches

Patch: github.com ↗Patch: github.com ↗

📋Vendor Advisories

Red Hat

envoy: Envoy crashes when idle and request per try timeout occur within the backoff interval↗2024-02-09

▶