CVE-2024-32974
📋 TL;DR
This CVE describes a use-after-free vulnerability in Envoy's QUIC implementation that can cause a crash when processing HTTP/3 requests. The vulnerability occurs when QUICHE continues to push request headers after StopReading() is called, potentially accessing already-destroyed ActiveStream objects. This affects any deployment using Envoy with QUIC/HTTP/3 enabled.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Denial of service through envoy proxy crash, potentially disrupting traffic flow for all services behind the proxy.
Likely Case
Intermittent envoy crashes under specific QUIC traffic patterns, causing service disruption until envoy restarts.
If Mitigated
Minimal impact with proper monitoring and automatic restart mechanisms in place.
🎯 Exploit Status
Exploitation requires sending specific QUIC traffic patterns but does not require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.30.2, 1.29.5, 1.28.6, or 1.27.8
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-mgxp-7hhp-8299
Restart Required: Yes
Instructions:
1. Identify current Envoy version. 2. Upgrade to patched version (1.30.2, 1.29.5, 1.28.6, or 1.27.8). 3. Restart Envoy service. 4. Verify new version is running.
🔧 Temporary Workarounds
Disable QUIC/HTTP/3
allTemporarily disable QUIC and HTTP/3 protocols to eliminate the attack surface.
Modify envoy configuration to remove QUIC listeners and use only HTTP/1.1 or HTTP/2
🧯 If You Can't Patch
- Implement rate limiting on QUIC connections to reduce likelihood of triggering the condition
- Deploy multiple envoy instances behind load balancer with health checks to minimize single-point failure impact
🔍 How to Verify
Check if Vulnerable:
Check envoy version and verify QUIC/HTTP/3 is enabled in configurationCheck Version:
envoy --versionVerify Fix Applied:
Verify envoy version is 1.30.2, 1.29.5, 1.28.6, or 1.27.8 or later📡 Detection & Monitoring
Log Indicators:
- Envoy crash logs
- Segmentation fault errors in system logs
- Unexpected envoy process termination
Network Indicators:
- Sudden drop in QUIC traffic
- Increased TCP fallback traffic
SIEM Query:
process.name="envoy" AND (event.type="crash" OR log_message="segmentation fault" OR log_message="SIGSEGV")