CVE-2024-32974

· MEDIUMModified

← All CVEs

CVSS v3.1

5.9

EPSS

0.69%

Published

Jun 4, 2024

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the stream. As after `StopReading()`, the HCM's `ActiveStream` might have already be destroyed and any up calls from QUICHE could potentially cause use after free.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-416CWE-416

Affected Products (4)

envoyproxy · envoy (up to 1.27.6)vulnerable

envoyproxy · envoy (up to 1.28.4)vulnerable

envoyproxy · envoy (up to 1.29.5)vulnerable

envoyproxy · envoy (up to 1.30.2)vulnerable

References (2)

https://github.com/envoyproxy/envoy/security/advisories/GHSA-mgxp-7hhp-8299

ExploitThird Party Advisory

https://github.com/envoyproxy/envoy/security/advisories/GHSA-mgxp-7hhp-8299

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs