CVE-2024-23322
📋 TL;DR
Envoy proxy crashes when specific timeout configurations overlap, causing a denial of service. This affects Envoy deployments with hedge_on_per_try_timeout, per_try_idle_timeout, and per-try-timeout enabled with matching timeout values.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage for all traffic passing through the affected Envoy proxy instance, requiring manual restart.
Likely Case
Intermittent crashes under specific timeout conditions, causing service disruption until automatic or manual recovery.
If Mitigated
No impact if configurations don't trigger the specific timeout overlap condition.
🎯 Exploit Status
Exploitation requires knowledge of specific timeout configurations and ability to send requests that trigger the conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.29.1, 1.28.1, 1.27.3, or 1.26.7
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-6p83-mfmh-qv38
Restart Required: Yes
Instructions:
1. Identify Envoy version currently running. 2. Upgrade to patched version (1.29.1, 1.28.1, 1.27.3, or 1.26.7). 3. Restart Envoy service. 4. Verify new version is running.
🔧 Temporary Workarounds
Disable vulnerable timeout configurations
allDisable either hedge_on_per_try_timeout, per_try_idle_timeout, or per-try-timeout to prevent the crash condition
Modify Envoy configuration to remove or disable the vulnerable timeout settings
🧯 If You Can't Patch
- Disable hedge_on_per_try_timeout in configuration
- Ensure per_try_idle_timeout and per-try-timeout values differ significantly to avoid overlap
🔍 How to Verify
Check if Vulnerable:
Check Envoy configuration for hedge_on_per_try_timeout: true, per_try_idle_timeout enabled, and per-try-timeout enabled with values that could overlapCheck Version:
envoy --versionVerify Fix Applied:
Verify Envoy version is 1.29.1, 1.28.1, 1.27.3, or 1.26.7 using version check command📡 Detection & Monitoring
Log Indicators:
- Envoy crash logs
- Segmentation fault errors
- Process termination messages
Network Indicators:
- Sudden loss of proxy connectivity
- HTTP 503 errors from upstream services
SIEM Query:
source="envoy" AND ("segmentation fault" OR "crash" OR "terminated")🔗 References
- https://github.com/envoyproxy/envoy/commit/843f9e6a123ed47ce139b421c14e7126f2ac685e
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-6p83-mfmh-qv38
- https://github.com/envoyproxy/envoy/commit/843f9e6a123ed47ce139b421c14e7126f2ac685e
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-6p83-mfmh-qv38
