CVE-2024-53269

Executive Summary

CVE-2024-53269 is a denial-of-service (DoS) vulnerability in the Envoy proxy's Happy Eyeballs sorting algorithm. When the algorithm encounters additional addresses that are not valid IP addresses (e.g., hostnames or malformed strings), it triggers a crash in the data plane, leading to service disruption. The vulnerability has a CVSS score of 4.5 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood. Patches are available in Envoy versions 1.30.8, 1.31.4, and 1.32.2. Users unable to upgrade can mitigate by disabling Happy Eyeballs or correcting IP configuration.

Supply Chain & Package Security

Envoy is a cloud-native proxy commonly distributed via Docker images, Helm charts, and source builds. Organizations using Envoy in service mesh or edge proxy roles should verify their deployment version and apply patches promptly. No malicious package indicators have been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: Low
• EPSS Score: 0.0% (Low exploitation probability)

Deep Dive & Mechanics

The Happy Eyeballs algorithm (RFC 8305) is designed to improve connection establishment by attempting multiple address families (IPv4 and IPv6) in parallel. In Envoy, this algorithm sorts resolved addresses to optimize connection attempts. The vulnerability occurs when the algorithm processes additional addresses that are not valid IP addresses (e.g., DNS names or malformed strings). The sorting logic fails to validate address types, leading to a null pointer dereference or similar crash condition in the data plane.

Root Cause: The sorting function assumes all addresses in the list are valid IP addresses. When a non-IP address is encountered, the algorithm attempts to perform IP-specific operations (e.g., comparing address families), causing a segmentation fault.

Impact: A remote attacker can trigger this by sending a request that causes Envoy to resolve a hostname with additional non-IP addresses (e.g., via DNS poisoning or crafted upstream responses). This crashes the Envoy worker thread, causing a denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// In happy_eyeballs.cc
void sortAddresses(std::vector<Address>& addresses) {
    for (auto& addr : addresses) {
        if (addr.isIp()) {
            // IP-specific sorting logic
        }
        // Missing else branch: non-IP addresses cause undefined behavior
    }
}

Patched Code:

// In happy_eyeballs.cc
void sortAddresses(std::vector<Address>& addresses) {
    for (auto& addr : addresses) {
        if (addr.isIp()) {
            // IP-specific sorting logic
        } else {
            // Skip non-IP addresses or handle gracefully
            continue;
        }
    }
}

The patch adds a check to skip non-IP addresses, preventing the crash.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy Envoy 1.30.7 with Happy Eyeballs enabled and a backend that returns a mix of IP and non-IP addresses in DNS responses.
2. Trigger: Send a request to Envoy that resolves to a hostname with additional non-IP addresses (e.g., via a malicious DNS server or upstream proxy).
3. Payload: Use a crafted DNS response with an A record containing a hostname instead of an IP address.
4. Expected Outcome: Envoy worker thread crashes, causing connection failures.

Example DNS response (malicious):

;; ANSWER SECTION:
example.com. 300 IN A 192.168.1.1
example.com. 300 IN A malicious-hostname

Blue Team

1. Detection: Monitor Envoy logs for crash signatures (e.g., segmentation fault, SIGSEGV).
2. Mitigation: Disable Happy Eyeballs via configuration (envoy.reloadable_features.happy_eyeballs set to false).
3. Validation: Verify DNS responses from upstream servers are sanitized to include only valid IP addresses.

Indicators of Compromise (IOCs)

• Log Entries: Envoy crash logs containing "SIGSEGV" or "segmentation fault" in the data plane.
• Network: DNS responses with non-IP addresses in A or AAAA records.
• Process: Envoy worker processes terminating unexpectedly.

Detection Engineering

YARA Rule

rule CVE_2024_53269_Envoy_HappyEyeballs_Crash {
    meta:
        description = "Detects Envoy crash logs related to Happy Eyeballs sorting"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53269"
    strings:
        $crash1 = "SIGSEGV" nocase
        $crash2 = "segmentation fault" nocase
        $happy = "happy_eyeballs" nocase
    condition:
        ($crash1 or $crash2) and $happy
}

Sigma Rule

title: Envoy Happy Eyeballs Crash Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Envoy crash events related to CVE-2024-53269
author: Valters IT
logsource:
    product: envoy
    service: proxy
detection:
    selection:
        EventID: 1000  # Windows crash event
        Image: "*envoy*"
        Details: "*SIGSEGV*"
    condition: selection
falsepositives:
    - Legitimate crashes from other causes
level: medium

Suricata Rule

alert dns any any -> any any (msg:"CVE-2024-53269 Envoy Happy Eyeballs Non-IP Address"; dns.rrname; content:"|00|"; dns.rrtype:A; content:"|00|"; dns.rdata; content:"|00|"; pcre:"/^[a-zA-Z]/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade: Update Envoy to versions 1.30.8, 1.31.4, or 1.32.2.
2. Workaround: Disable Happy Eyeballs by setting envoy.reloadable_features.happy_eyeballs to false in the Envoy configuration.
3. Network Controls: Validate DNS responses to ensure only valid IP addresses are returned.
4. Monitoring: Enable crash logging and alert on Envoy worker process terminations.

Valters IT
DevSecOps & Cyber Threat Intelligence