CVE-2024-23327
📋 TL;DR
A NULL pointer dereference vulnerability in Envoy proxy when PPv2 is enabled on both listener and cluster configurations causes a segmentation fault when processing specific LOCAL command requests without protocol blocks. This affects Envoy instances with PPv2 enabled in vulnerable versions, potentially causing denial of service.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through denial of service via segmentation fault crash of Envoy proxy, potentially affecting all traffic through the proxy.
Likely Case
Intermittent service disruption when specific LOCAL command requests trigger the segmentation fault, causing partial downtime.
If Mitigated
No impact if PPv2 is not enabled on both listener and cluster, or if vulnerable versions are not in use.
🎯 Exploit Status
Exploitation requires knowledge of specific configuration and ability to send LOCAL command requests without protocol blocks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.29.1, 1.28.1, 1.27.3, or 1.26.7
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j
Restart Required: Yes
Instructions:
1. Identify current Envoy version. 2. Upgrade to patched version (1.29.1, 1.28.1, 1.27.3, or 1.26.7). 3. Restart Envoy service. 4. Verify version and functionality.
🔧 Temporary Workarounds
Disable PPv2
allDisable PPv2 on either listener or cluster configurations to prevent the vulnerable code path.
# Edit Envoy configuration to remove PPv2 settings from listener or cluster
🧯 If You Can't Patch
- Disable PPv2 on all listener and cluster configurations
- Implement network controls to filter LOCAL command requests without protocol blocks
🔍 How to Verify
Check if Vulnerable:
Check Envoy configuration for PPv2 enabled on both listener and cluster, and verify version is before patched releases.Check Version:
envoy --versionVerify Fix Applied:
Verify Envoy version is 1.29.1, 1.28.1, 1.27.3, or 1.26.7, and test with LOCAL command requests.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in Envoy logs
- Process crashes with signal 11 (SIGSEGV)
- Unexpected Envoy restarts
Network Indicators:
- Sudden loss of proxy connectivity
- Increased 5xx errors from upstream services
SIEM Query:
process.name="envoy" AND (event.action="crash" OR log.level="error" AND log.message:"segmentation fault")🔗 References
- https://github.com/envoyproxy/envoy/commit/63895ea8e3cca9c5d3ab4c5c128ed1369969d54a
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j
- https://github.com/envoyproxy/envoy/commit/63895ea8e3cca9c5d3ab4c5c128ed1369969d54a
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j
