CVE-2021-43826
📋 TL;DR
Envoy proxy versions with upstream tunneling configured can crash when a downstream client disconnects while the upstream connection is still being established. This denial-of-service vulnerability affects all Envoy deployments using tunneling configurations. The crash occurs due to a use-after-free condition (CWE-416).
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption for all traffic passing through the affected Envoy instance, requiring manual restart and causing extended downtime.
Likely Case
Intermittent crashes of Envoy instances under specific network conditions, leading to partial service disruption and degraded reliability.
If Mitigated
No impact if patched or if tunneling configuration is not used; otherwise, crashes may still occur but can be automatically recovered by orchestration systems.
🎯 Exploit Status
Exploitation requires only network access to trigger the specific timing condition. No authentication or special packets needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.20.2, 1.19.3, 1.18.6, or 1.17.3
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf
Restart Required: Yes
Instructions:
1. Identify Envoy version. 2. Upgrade to patched version (1.20.2, 1.19.3, 1.18.6, or 1.17.3). 3. Restart Envoy service. 4. Verify new version is running.
🔧 Temporary Workarounds
Disable Upstream Tunneling
allRemove or disable tunneling_config from TCP proxy configurations if not required for functionality.
# Edit Envoy configuration to remove tunneling_config sections
# Example: Remove or comment out tunneling_config: in YAML configs
🧯 If You Can't Patch
- Disable upstream tunneling configuration if not absolutely required
- Implement circuit breakers and automatic restart mechanisms to minimize downtime from crashes
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and configuration for tunneling_config usage. Vulnerable if version < 1.20.2, 1.19.3, 1.18.6, or 1.17.3 AND tunneling_config is present.Check Version:
envoy --versionVerify Fix Applied:
Confirm Envoy version is 1.20.2, 1.19.3, 1.18.6, or 1.17.3 or higher, and verify service remains stable during connection churn.📡 Detection & Monitoring
Log Indicators:
- Envoy crash logs
- Segmentation fault errors
- Process termination without normal shutdown
Network Indicators:
- Sudden loss of connectivity through Envoy
- Increased TCP connection resets
SIEM Query:
process.name:"envoy" AND (log_level:error OR log_level:critical) AND message:"crash" OR "segmentation fault"🔗 References
- https://github.com/envoyproxy/envoy/commit/ce0ae309057a216aba031aff81c445c90c6ef145
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf
- https://github.com/envoyproxy/envoy/commit/ce0ae309057a216aba031aff81c445c90c6ef145
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf
