Arbitrary Memory Access Vulnerability in Envoy Due to Freed Memory Reference
CVE-2024-39305

6.5MEDIUM

Key Information:

Vendor

Envoyproxy

Status
Envoy
Vendor
CVE Published:
1 July 2024

What is CVE-2024-39305?

Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already freed memory when route hash policy is configured with cookie attributes. Note that this vulnerability has been fixed in the open as the effect would be immediately apparent if it was configured. Memory allocated for holding attribute values is freed after configuration was parsed. During request processing Envoy will attempt to copy content of de-allocated memory into request cookie header. This can lead to arbitrary content of Envoy's memory to be sent to the upstream service or abnormal process termination. This vulnerability is fixed in Envoy versions v1.30.4, v1.29.7, v1.28.5, and v1.27.7. As a workaround, do not use cookie attributes in route action hash policy.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

envoy >= 1.30.0, < 1.30.4 < 1.30.0, 1.30.4

envoy >= 1.29.0, < 1.29.7 < 1.29.0, 1.29.7

envoy >= 1.28.0, < 1.28.5 < 1.28.0, 1.28.5

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/commit/02a06681fbe0e0...
x_refsource_MISC
https://github.com/envoyproxy/envoy/commit/50b384cb203a1f...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.