CVE-2021-28683
📋 TL;DR
This vulnerability in Envoy proxy allows remote attackers to cause a denial of service by sending a specially crafted TLS alert with an unknown alert code, triggering a NULL pointer dereference and crash. It affects all Envoy deployments using TLS connections. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of Envoy proxy, disrupting all traffic routing through the affected instance, potentially causing cascading failures in dependent services.
Likely Case
Denial of service affecting specific TLS connections, causing temporary service disruption until Envoy restarts automatically or manually.
If Mitigated
Minimal impact with proper monitoring and automatic restart mechanisms in place, though brief service interruptions may occur.
🎯 Exploit Status
Exploitation requires sending a malformed TLS alert packet to a vulnerable Envoy instance. The vulnerability is simple to trigger and has been publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.72.0 and later
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-r22g-5f3x-xjgg
Restart Required: Yes
Instructions:
1. Upgrade Envoy to version 1.72.0 or later. 2. Replace the Envoy binary with the patched version. 3. Restart the Envoy service. 4. Verify the new version is running.
🔧 Temporary Workarounds
TLS Alert Filtering
linuxUse network filtering to block TLS alert packets with unknown alert codes before they reach Envoy
iptables -A INPUT -p tcp --dport 443 -m string --hex-string '|15 03 03 00 02|' --algo bm -j DROP
🧯 If You Can't Patch
- Implement network segmentation to limit which systems can send TLS traffic to Envoy instances
- Deploy redundant Envoy instances with load balancing to maintain service during individual instance crashes
🔍 How to Verify
Check if Vulnerable:
Check Envoy version: envoy --version. If version is 1.71.1 or earlier, the system is vulnerable.Check Version:
envoy --version | grep -o 'version: [0-9.]*'Verify Fix Applied:
Verify Envoy version is 1.72.0 or later and monitor for crashes after applying the patch.📡 Detection & Monitoring
Log Indicators:
- Envoy process crashes
- Segmentation fault errors in logs
- Unexpected termination of Envoy service
Network Indicators:
- TLS alert packets with unusual alert codes
- Sudden drops in TLS connections
SIEM Query:
source="envoy.logs" AND ("segmentation fault" OR "crash" OR "terminated unexpectedly")🔗 References
- https://blog.envoyproxy.io
- https://github.com/envoyproxy/envoy/releases
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r22g-5f3x-xjgg
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-xw4q-6pj2-5gfg
- https://blog.envoyproxy.io
- https://github.com/envoyproxy/envoy/releases
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r22g-5f3x-xjgg
