CVE-2022-21655
📋 TL;DR
This vulnerability in Envoy proxy causes a segmentation fault when internal redirects select routes configured with direct response or redirect actions, leading to denial of service. It affects Envoy deployments using these specific route configurations. The crash can be triggered by malicious traffic.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of Envoy proxy, disrupting all traffic routing through the affected instance.
Likely Case
Intermittent crashes causing service disruption and potential cascading failures in load-balanced environments.
If Mitigated
No impact if internal redirects are disabled or vulnerable configurations are avoided.
🎯 Exploit Status
Exploitation requires sending traffic that triggers internal redirects to vulnerable routes. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.21.2, 1.20.3, 1.19.4, 1.18.6 or later
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg
Restart Required: Yes
Instructions:
1. Update Envoy to patched version. 2. Restart Envoy service. 3. Verify configuration compatibility with new version.
🔧 Temporary Workarounds
Disable internal redirects
allTurn off internal redirects if direct response entries are configured on the same listener
Modify Envoy configuration to set 'internal_redirect_action: PASS_THROUGH_INTERNAL_REDIRECT' or remove internal redirect configurations
🧯 If You Can't Patch
- Apply the workaround to disable internal redirects in vulnerable configurations
- Implement network controls to limit traffic that could trigger internal redirects
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and configuration for internal redirects with direct response/redirect routes on same listenerCheck Version:
envoy --versionVerify Fix Applied:
Verify Envoy version is 1.21.2, 1.20.3, 1.19.4, 1.18.6 or later and monitor for crashes📡 Detection & Monitoring
Log Indicators:
- Segmentation fault logs
- Envoy crash/restart events
- Error logs mentioning internal redirect failures
Network Indicators:
- Sudden drop in traffic through Envoy
- Increased 5xx errors from upstream services
SIEM Query:
source="envoy" AND ("segmentation fault" OR "SIGSEGV" OR "crash" OR "panic")🔗 References
- https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d8c350682
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg
- https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d8c350682
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg
