CVE-2021-32781
📋 TL;DR
CVE-2021-32781 is a use-after-free vulnerability in Envoy proxy that allows specifically crafted requests to cause denial of service. It affects Envoy deployments using extensions that modify request/response body sizes, such as decompressor, json-transcoder, or grpc-web filters. Attackers can crash Envoy instances by exploiting buffer overflow conditions during filter chain processing.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption with Envoy process crashes leading to unavailability of all proxied services
Likely Case
Intermittent denial of service affecting specific requests when malicious payloads are processed
If Mitigated
No impact if vulnerable extensions are disabled or patched versions are deployed
🎯 Exploit Status
Exploitation requires specifically crafted requests and vulnerable filter configurations
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.19.1, 1.18.4, 1.17.4, 1.16.5
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vhv-gp9v-42qv
Restart Required: Yes
Instructions:
1. Identify current Envoy version. 2. Upgrade to patched version (1.19.1, 1.18.4, 1.17.4, or 1.16.5). 3. Restart Envoy service. 4. Verify version after restart.
🔧 Temporary Workarounds
Disable vulnerable extensions
allRemove or disable extensions that modify request/response body sizes
# Edit Envoy configuration to remove: decompressor, json-transcoder, grpc-web filters
# Restart Envoy after configuration changes
🧯 If You Can't Patch
- Disable all body-modifying extensions in Envoy configuration
- Implement network controls to filter malicious requests before they reach Envoy
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and configuration for vulnerable extensionsCheck Version:
envoy --versionVerify Fix Applied:
Confirm Envoy version is 1.19.1, 1.18.4, 1.17.4, or 1.16.5 and monitor for crashes📡 Detection & Monitoring
Log Indicators:
- Envoy process crashes
- Segmentation fault errors
- Abnormal termination logs
Network Indicators:
- Sudden service unavailability
- Increased error rates from Envoy
SIEM Query:
source="envoy" AND ("segmentation fault" OR "crash" OR "SIGSEGV")🔗 References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vhv-gp9v-42qv
- https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vhv-gp9v-42qv
- https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history
