// For flags

CVE-2024-32974

Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the stream. As after `StopReading()`, the HCM's `ActiveStream` might have already be destroyed and any up calls from QUICHE could potentially cause use after free.

Envoy es un proxy de servicio y borde de código abierto, nativo de la nube. Se observó un bloqueo en `EnvoyQuicServerStream::OnInitialHeadersComplete()` con la siguiente pila de llamadas. Es un use-after-free causado porque QUICHE continúa enviando encabezados de solicitud después de que se llama a `StopReading()` en la secuencia. Al igual que después de `StopReading()`, es posible que el `ActiveStream` del HCM ya se haya destruido y cualquier llamada desde QUICHE podría provocar su use after free.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-04-22 CVE Reserved
  • 2024-06-04 CVE Published
  • 2024-06-13 EPSS Updated
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-416: Use After Free
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Envoyproxy
Search vendor "Envoyproxy"
 Envoy
Search vendor "Envoyproxy" for product "Envoy"
 < 1.27.6
Search vendor "Envoyproxy" for product "Envoy" and version " < 1.27.6"
-
Affected
Envoyproxy
Search vendor "Envoyproxy"
 Envoy
Search vendor "Envoyproxy" for product "Envoy"
 >= 1.28.0 < 1.28.4
Search vendor "Envoyproxy" for product "Envoy" and version " >= 1.28.0 < 1.28.4"
-
Affected
Envoyproxy
Search vendor "Envoyproxy"
 Envoy
Search vendor "Envoyproxy" for product "Envoy"
 >= 1.29.0 < 1.29.5
Search vendor "Envoyproxy" for product "Envoy" and version " >= 1.29.0 < 1.29.5"
-
Affected
Envoyproxy
Search vendor "Envoyproxy"
 Envoy
Search vendor "Envoyproxy" for product "Envoy"
 >= 1.30.0 < 1.30.2
Search vendor "Envoyproxy" for product "Envoy" and version " >= 1.30.0 < 1.30.2"
-
Affected