CVE-2024-45807
📋 TL;DR
Envoy proxy versions using the default oghttp2 HTTP/2 codec contain stream management bugs that can cause crashes. This affects all Envoy 1.31 deployments with default configurations. The vulnerability allows denial of service through proxy crashes.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage as Envoy crashes repeatedly, disrupting all traffic routing through the proxy
Likely Case
Intermittent crashes causing service disruptions and degraded performance
If Mitigated
No impact if patched or if oghttp2 is manually disabled
🎯 Exploit Status
The advisory suggests the vulnerability can be triggered remotely without authentication, though specific exploit details aren't public
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.31.2
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-qc52-r4x5-9w37
Restart Required: Yes
Instructions:
1. Download Envoy 1.31.2 from official sources. 2. Replace existing Envoy binary with patched version. 3. Restart Envoy service. 4. Verify version with 'envoy --version'
🔧 Temporary Workarounds
Disable oghttp2 codec
allManually configure Envoy to use a different HTTP/2 codec instead of the default oghttp2
Modify Envoy configuration to set 'http2_protocol_options: { use_oghttp2_codec: false }'
🧯 If You Can't Patch
- Implement network segmentation to limit access to Envoy instances
- Deploy additional monitoring and alerting for Envoy crash events
🔍 How to Verify
Check if Vulnerable:
Check Envoy version with 'envoy --version' and verify if it's between 1.31.0 and 1.31.1Check Version:
envoy --versionVerify Fix Applied:
Confirm version is 1.31.2 or higher with 'envoy --version' and monitor for crash events📡 Detection & Monitoring
Log Indicators:
- Envoy crash logs
- Unexpected termination events
- Segmentation fault errors in system logs
Network Indicators:
- Sudden loss of connectivity through Envoy proxy
- Increased connection timeouts
SIEM Query:
source="envoy" AND ("crash" OR "segmentation fault" OR "terminated unexpectedly")