CVE-2024-34362

Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream

Severity Score

5.9

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in `HttpConnectionManager` (HCM) with `EnvoyQuicServerStream` that can crash Envoy. An attacker can exploit this vulnerability by sending a request without `FIN`, then a `RESET_STREAM` frame, and then after receiving the response, closing the connection.

Envoy es un proxy de servicio y borde de código abierto, nativo de la nube. Hay un use-after-free en `HttpConnectionManager` (HCM) con `EnvoyQuicServerStream` que puede bloquear Envoy. Un atacante puede explotar esta vulnerabilidad enviando una solicitud sin `FIN`, luego un framework `RESET_STREAM` y luego, después de recibir la respuesta, cerrando la conexión.

*Credits: N/A

CVSS Scores

NISTv3.1 5.9

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

Poc

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-02 CVE Reserved
2024-06-04 CVE Published
2024-06-13 EPSS Updated
2024-08-19 CVE Updated
2024-08-19 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-416: Use After Free

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC
https://github.com/envoyproxy/envoy/security/advisories/GHSA-hww5-43gv-35jv	2024-08-19

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Envoyproxy Search vendor "Envoyproxy"		Envoy Search vendor "Envoyproxy" for product "Envoy"				< 1.27.6 Search vendor "Envoyproxy" for product "Envoy" and version " < 1.27.6"		-		Affected
Envoyproxy Search vendor "Envoyproxy"		Envoy Search vendor "Envoyproxy" for product "Envoy"				>= 1.28.0 < 1.28.4 Search vendor "Envoyproxy" for product "Envoy" and version " >= 1.28.0 < 1.28.4"		-		Affected
Envoyproxy Search vendor "Envoyproxy"		Envoy Search vendor "Envoyproxy" for product "Envoy"				>= 1.29.0 < 1.29.5 Search vendor "Envoyproxy" for product "Envoy" and version " >= 1.29.0 < 1.29.5"		-		Affected
Envoyproxy Search vendor "Envoyproxy"		Envoy Search vendor "Envoyproxy" for product "Envoy"				>= 1.30.0 < 1.30.2 Search vendor "Envoyproxy" for product "Envoy" and version " >= 1.30.0 < 1.30.2"		-		Affected