CVE-2024-53270
📋 TL;DR
Envoy proxy versions before 1.32.3, 1.31.5, 1.30.9, and 1.29.12 contain a null pointer dereference vulnerability when the http1_server_abort_dispatch load shed point is configured. This can cause Envoy to crash when HTTP/2 upstream resets occur during specific conditions. Any organization using affected Envoy versions with this configuration is vulnerable.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Denial of service causing Envoy proxy crashes, potentially disrupting all traffic through the proxy and requiring manual restart.
Likely Case
Intermittent crashes during high-load scenarios when HTTP/2 upstream resets occur, leading to service disruption.
If Mitigated
No impact if load shed point is disabled or patched versions are used.
🎯 Exploit Status
Exploitation requires triggering specific conditions with HTTP/2 upstream resets while the load shed point is active.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.32.3, 1.31.5, 1.30.9, or 1.29.12
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-q9qv-8j52-77p3
Restart Required: Yes
Instructions:
1. Identify current Envoy version. 2. Upgrade to patched version (1.32.3, 1.31.5, 1.30.9, or 1.29.12). 3. Restart Envoy service. 4. Verify version after restart.
🔧 Temporary Workarounds
Disable vulnerable load shed point
allRemove or disable the http1_server_abort_dispatch load shed point configuration
Remove http1_server_abort_dispatch from Envoy configuration files
Set high threshold for load shedding
allConfigure a very high threshold to minimize triggering of the vulnerable code path
Set high threshold value for http1_server_abort_dispatch in configuration
🧯 If You Can't Patch
- Disable http1_server_abort_dispatch load shed point in all Envoy configurations
- Implement monitoring for Envoy crashes and automated restart procedures
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and configuration for http1_server_abort_dispatch load shed pointCheck Version:
envoy --versionVerify Fix Applied:
Confirm Envoy version is 1.32.3, 1.31.5, 1.30.9, or 1.29.12 or later📡 Detection & Monitoring
Log Indicators:
- Envoy crash logs
- Segmentation fault errors
- Unexpected process termination
Network Indicators:
- Sudden loss of proxy connectivity
- HTTP 503 errors from upstream services
SIEM Query:
process_name="envoy" AND (event_type="crash" OR exit_code="139" OR signal="SIGSEGV")