CVE-2024-53270

Executive Summary

CVE-2024-53270 is a high-severity NULL pointer dereference vulnerability in the Envoy proxy, specifically within the HTTP/1.1 codec's load shedding mechanism. When the http1_server_abort_dispatch load shed point is configured, a race condition during upstream H/2 resets can cause the active_request_ pointer to be null when sendOverloadError is invoked. This leads to a crash (denial of service) of the Envoy process. The vulnerability is remotely exploitable without authentication, and the CVSS score is 7.5 (High). Patches are available in the latest stable releases. Users unable to upgrade can disable the vulnerable load shed point as a workaround.

Supply Chain & Package Security

Envoy is a critical component in many cloud-native service meshes (e.g., Istio, Consul Connect) and API gateways. A crash in Envoy can lead to cascading failures across microservices architectures. The vulnerability is introduced through configuration, not a malicious package, but the impact on the supply chain is significant as it can be triggered by any downstream client sending a request that gets reset upstream.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required beyond a specific configuration.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The crash is confined to the Envoy process.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service.

Threat Level: High. The vulnerability is easy to exploit (low complexity, no privileges) and results in a denial of service. The EPSS score of 0.0% suggests low active exploitation in the wild, but the potential for impact is significant.

Deep Dive & Mechanics

The vulnerability resides in the HTTP/1.1 codec's handling of load shedding. When envoy.load_shed_points.http1_server_abort_dispatch is enabled, Envoy can abort dispatching new requests if it is overloaded. The function sendOverloadError is called to send an error response back to the client.

The bug occurs because sendOverloadError unconditionally dereferences active_request_ without checking if it is null. Under normal conditions, active_request_ is set when a new HTTP/1.1 message begins (onMessageBeginImpl). However, if the stream is reset (e.g., due to an upstream H/2 reset) before the message is fully established, onMessageBeginImpl returns early with an ok status, leaving active_request_ as nullptr. When the load shed point subsequently triggers sendOverloadError, the null pointer dereference causes a segmentation fault.

The race condition is as follows:

1. A downstream client sends an HTTP/1.1 request.
2. Envoy initiates an upstream H/2 connection for the request.
3. The upstream H/2 stream is reset (e.g., due to a timeout or error).
4. The reset propagates back to the HTTP/1.1 codec, causing onMessageBeginImpl to return early.
5. Before the HTTP/1.1 codec can clean up, the load shed point triggers sendOverloadError.
6. sendOverloadError accesses active_request_-> which is null, causing a crash.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

void Http1ServerConnectionImpl::sendOverloadError() {
  // No null check for active_request_
  active_request_->sendLocalReply(...);
}

Patched Code (simplified):

void Http1ServerConnectionImpl::sendOverloadError() {
  if (active_request_ == nullptr) {
    return; // or handle gracefully
  }
  active_request_->sendLocalReply(...);
}

The patch adds a simple null pointer check before dereferencing active_request_. This prevents the crash when the pointer is null.

Exploitation & Lab Setup

Red Team

Prerequisites:

• An Envoy instance with http1_server_abort_dispatch load shed point enabled.
• Ability to send HTTP/1.1 requests that trigger an upstream H/2 reset.

Exploitation Steps:

1. Identify an Envoy proxy that has the vulnerable configuration.
2. Send a crafted HTTP/1.1 request that will cause an upstream H/2 reset. This can be achieved by:
   • Sending a request to a backend that is slow to respond, then timing out.
   • Sending a request that triggers an error on the upstream server.
3. The race condition will cause the Envoy process to crash, resulting in a denial of service.

Example using curl (conceptual):

# Send a request that will be proxied to an upstream that will reset the stream
curl -v --http1.1 http://envoy-proxy:10000/slow-backend

Note: No public exploit code is available. The exploitation relies on triggering the race condition naturally.

Blue Team

Detection:

• Monitor Envoy logs for crashes or segmentation faults.
• Look for repeated patterns of upstream H/2 resets followed by Envoy process restarts.
• Use the detection rules provided below.

Mitigation:

• Apply the patch by upgrading to a fixed version.
• If unable to upgrade, disable the http1_server_abort_dispatch load shed point.
• Increase the load shedding threshold to reduce the likelihood of triggering the vulnerable code path.

Indicators of Compromise (IOCs)

• Log Entries: Envoy crash logs containing SIGSEGV or segfault in the HTTP/1.1 codec.
• Process Behavior: Unexpected restarts of the Envoy process.
• Network Patterns: A high rate of upstream H/2 resets followed by client connection drops.

Detection Engineering

YARA Rule

rule CVE_2024_53270_Envoy_Null_Pointer_Dereference {
    meta:
        description = "Detects Envoy crash logs indicating CVE-2024-53270 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-53270"
    strings:
        $crash1 = "SIGSEGV" nocase
        $crash2 = "segfault" nocase
        $codec = "http1_server_abort_dispatch" nocase
        $nullptr = "null pointer" nocase
    condition:
        any of ($crash*) and $codec and $nullptr
}

Sigma Rule

title: Envoy Crash Due to CVE-2024-53270
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Envoy process crashes related to the http1_server_abort_dispatch null pointer dereference.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-53270
logsource:
    product: envoy
    service: proxy
detection:
    selection:
        - EventID: 1000  # Windows crash event
        - EventID: 7     # Linux segfault
        - Message: "*SIGSEGV*"
        - Message: "*segfault*"
        - Message: "*http1_server_abort_dispatch*"
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert tcp any any -> any 10000 (msg:"CVE-2024-53270 Envoy HTTP/1.1 Load Shed Crash Attempt"; flow:to_server; content:"|0d 0a|"; http_header; content:"Host"; http_header; pcre:"/^Host\s*:\s*[^\r\n]+/mi"; threshold: type both, track by_src, count 5, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Envoy to version 1.32.3, 1.31.5, 1.30.9, or 1.29.12 (or later).
2. If upgrading is not possible, disable the http1_server_abort_dispatch load shed point in the Envoy configuration:

   load_shed_points:
     http1_server_abort_dispatch:
       enabled: false
   

3. Alternatively, increase the load shedding threshold to make it less likely to trigger the vulnerable code path.

Long-term Actions:

• Implement a robust patch management process for Envoy and other critical infrastructure components.
• Monitor for new CVEs and apply patches promptly.
• Use a Web Application Firewall (WAF) to filter malicious traffic.

Valters IT – Securing your digital frontier.