CVE-2022-23635
Unauthenticated control plane denial of service attack in Istio
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [multicluster](https://istio.io/latest/docs/setup/install/multicluster/primary-remote/) topologies, this port is exposed over the public internet. There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.
Istio es una plataforma abierta para conectar, gestionar y asegurar microservicios. En las versiones afectadas, el plano de control de Istio, `istiod`, es vulnerable a un error de procesamiento de solicitudes, lo que permite a un atacante malicioso que envíe un mensaje especialmente diseñado que resulte en la caída del plano de control. Este punto final se sirve a través del puerto 15012 de TLS, pero no requiere ninguna autenticación por parte del atacante. Para instalaciones sencillas, Istiod normalmente sólo es alcanzable desde dentro del clúster, limitando el radio de explosión. Sin embargo, para algunos despliegues, especialmente las topologías [multicluster](https://istio.io/latest/docs/setup/install/multicluster/primary-remote/), este puerto está expuesto a través de la Internet pública. No hay medidas de mitigación adicionales efectivas, más allá de la actualización. Limitar el acceso a la red a Istiod al conjunto mínimo de clientes puede ayudar a reducir el alcance de la vulnerabilidad hasta cierto punto
A flaw was found in istio. This flaw allows an attacker to send a specially crafted message to isitiod, causing the control plane to crash.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-01-19 CVE Reserved
- 2022-02-22 CVE Published
- 2024-08-03 CVE Updated
- 2024-11-07 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-287: Improper Authentication
- CWE-1284: Improper Validation of Specified Quantity in Input
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://github.com/istio/istio/security/advisories/GHSA-856q-xv3c-7f2f | Issue Tracking | |
| https://istio.io/latest/news/security/istio-security-2022-003 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/istio/istio/commit/5f3b5ed958ae75156f8656fe7b3794f78e94db84 | 2023-07-13 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-23635 | 2022-04-07 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2057277 | 2022-04-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Istio Search vendor "Istio" | Istio Search vendor "Istio" for product "Istio" | < 1.11.7 Search vendor "Istio" for product "Istio" and version " < 1.11.7" | - |
Affected
| ||||||
| Istio Search vendor "Istio" | Istio Search vendor "Istio" for product "Istio" | >= 1.12.0 < 1.12.4 Search vendor "Istio" for product "Istio" and version " >= 1.12.0 < 1.12.4" | - |
Affected
| ||||||
| Istio Search vendor "Istio" | Istio Search vendor "Istio" for product "Istio" | >= 1.13.0 < 1.13.1 Search vendor "Istio" for product "Istio" and version " >= 1.13.0 < 1.13.1" | - |
Affected
| ||||||