CVE-2024-45810

Executive Summary

CVE-2024-45810 is a high-severity denial-of-service vulnerability in the Envoy proxy, a cloud-native edge and service proxy. The flaw resides in the HTTP async client component, specifically within the sendLocalReply function. Under certain conditions, such as during WebSocket upgrades or request mirroring, Envoy will crash due to a use-after-free (CWE-416) condition. The crash occurs because the async stream's router is destroyed during the destructor of the async stream, while the stream itself is deferred for deletion. This leads to a situation where the stream decoder is destroyed, but its reference is still called in router.onDestroy(), causing a segmentation fault. This vulnerability can be exploited to cause a denial of service, impacting services like ext_authz if the upgrade and connection headers are allowed, and request mirroring. The CVSS score is 6.5 (Medium), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. No public proof-of-concept (POC) or exploit code is available at this time.

Supply Chain & Package Security

Envoy is a critical component in many cloud-native environments, often deployed as a sidecar proxy in service meshes like Istio. The vulnerability affects the core proxy binary, which is typically distributed via official Docker images and package repositories. Organizations using Envoy in their infrastructure should treat this as a high-priority update, as a crash can lead to service disruption. The fix is included in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade immediately. There are no known workarounds.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex attack sequences are required.
• Privileges Required: None (PR:N) – No authentication or privileges are needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: None (I:N) – No data is modified.
• Availability Impact: High (A:H) – The service can be crashed, leading to denial of service.

Threat Level: Medium. While the CVSS score is 6.5, the availability impact is high, and the attack complexity is low. The lack of a public POC reduces immediate risk, but the vulnerability is easily exploitable once understood.

Deep Dive & Mechanics

The vulnerability is a use-after-free (CWE-416) in Envoy's HTTP async client. The HTTP async client is used for outbound HTTP requests from Envoy itself, such as when it communicates with an external authorization service (ext_authz). The crash occurs in the sendLocalReply function under specific circumstances, such as when handling WebSocket upgrades or request mirroring.

Root Cause:

1. Status Code Duplication: The HTTP async client duplicates the status code during sendLocalReply, leading to an inconsistent state.
2. Deferred Deletion: The async stream is deferred for deletion, but the router's destructor is called during the async stream's destructor. This creates a race condition where the stream decoder is destroyed, but its reference is still used in router.onDestroy().

Trigger Conditions:

• WebSocket upgrade requests.
• Request mirroring configurations.
• Allowing upgrade and connection headers in ext_authz.

Impact:

• Segmentation fault (crash) of the Envoy process.
• Denial of service for all services relying on that Envoy instance.

Vulnerable vs. Patched Code

The fix addresses the use-after-free by ensuring proper lifecycle management of the async stream and its associated router. The patch likely involves:

• Preventing the duplication of status codes in sendLocalReply.
• Ensuring that the router's destructor is not called after the stream decoder has been destroyed.
• Properly synchronizing the deferred deletion of the async stream.

Vulnerable Code (Conceptual):

void AsyncStream::sendLocalReply(Status status) {
    // Duplicate status code
    status_ = status;
    // ... other logic
    router_.onDestroy(); // Called in destructor, but stream may be deferred
}

Patched Code (Conceptual):

void AsyncStream::sendLocalReply(Status status) {
    // No duplication
    // ... other logic
    // Ensure router is not destroyed before stream
}

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service by crashing the Envoy proxy.

Prerequisites:

• Access to an Envoy instance with the HTTP async client enabled.
• The instance must be configured to allow WebSocket upgrades or request mirroring.
• The upgrade and connection headers must be allowed in ext_authz.

Exploitation Steps:

1. Identify an Envoy endpoint that supports WebSocket upgrades.
2. Send a crafted WebSocket upgrade request.
3. The Envoy process will crash due to the use-after-free, causing a denial of service.

Example Request:

GET /ws HTTP/1.1
Host: target-envoy.com
Upgrade: websocket
Connection: Upgrade

Note: No public exploit code is available. This is a conceptual approach.

Blue Team

Detection:

• Monitor Envoy logs for segmentation faults or crashes.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Upgrade to a patched version (1.31.2, 1.30.6, 1.29.9, or 1.28.7).
• If upgrade is not possible, disable WebSocket upgrades and request mirroring.
• Restrict the upgrade and connection headers in ext_authz.

Indicators of Compromise (IOCs)

• Log Entries: Envoy crash logs containing "segmentation fault", "SIGSEGV", or "async stream" errors.
• Network Traffic: WebSocket upgrade requests targeting Envoy endpoints.
• Process Behavior: Unexpected termination of Envoy processes.

Detection Engineering

YARA Rule

rule CVE_2024_45810_Envoy_Crash {
    meta:
        description = "Detects Envoy crash logs related to CVE-2024-45810"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45810"
    strings:
        $crash1 = "segmentation fault" ascii nocase
        $crash2 = "SIGSEGV" ascii nocase
        $crash3 = "async stream" ascii nocase
        $crash4 = "sendLocalReply" ascii nocase
    condition:
        any of ($crash*) and filesize < 10MB
}

Sigma Rule

title: Envoy Crash Due to CVE-2024-45810
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects Envoy crash events related to CVE-2024-45810
author: Valters IT
date: 2024-10-27
logsource:
    product: envoy
    service: proxy
detection:
    selection:
        EventID: 1000  # Windows Event ID for application crash
        Provider: "Envoy"
        Message|contains:
            - "segmentation fault"
            - "SIGSEGV"
            - "async stream"
            - "sendLocalReply"
    condition: selection
falsepositives:
    - Legitimate crashes due to other reasons
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45810 - Envoy WebSocket Upgrade Crash Attempt"; flow:to_server; content:"Upgrade"; http_header; content:"websocket"; http_header; content:"Connection"; http_header; content:"Upgrade"; http_header; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Envoy to version 1.31.2, 1.30.6, 1.29.9, or 1.28.7.
2. Disable WebSocket upgrades and request mirroring if upgrade is not possible.
3. Restrict headers in ext_authz to block upgrade and connection headers.

Long-Term Measures:

• Implement regular vulnerability scanning for Envoy deployments.
• Monitor for new patches and advisories from the Envoy project.
• Use a Web Application Firewall (WAF) to filter malicious requests.

Workarounds:

• None known. Upgrade is the only reliable fix.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert