CVE-2025-54588

Executive Summary

CVE-2025-54588 is a high-severity use-after-free (UAF) vulnerability in the DNS cache of Envoy proxy, affecting versions 1.34.0 through 1.34.4 and 1.35.0. The flaw resides in the Dynamic Forward Proxy (DFP) implementation, where a completion callback for a DNS resolution can trigger new DNS resolutions or remove existing pending ones, leading to a dangling pointer and abnormal process termination (denial of service). The vulnerability is exploitable when the Dynamic Forwarding Filter is enabled, the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag is set to true, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. No public proof-of-concept or exploit code is available, and the EPSS score is 0.0%, indicating low active exploitation likelihood. The vendor has released patches in versions 1.34.5 and 1.35.1.

Supply Chain & Package Security

Envoy is a widely used open-source L7 proxy and communication bus, often deployed as a sidecar proxy in service meshes (e.g., Istio, Consul Connect). The vulnerability affects the core proxy binary, not a package manager distribution. However, organizations using Envoy as a container image or binary from official sources should verify their version and update to the patched release. No malicious packages or compromised supply chain artifacts have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be triggered remotely.
• Attack Complexity: Low (AC:L) – No special conditions beyond enabling the DFP filter and runtime flag.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component remains isolated.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Leads to abnormal process termination (DoS).

Threat Level: High. While no active exploitation is reported, the vulnerability is remotely triggerable with low complexity and can cause denial of service in critical infrastructure.

Deep Dive & Mechanics

The vulnerability is a classic use-after-free (CWE-416) in Envoy's DNS cache, specifically within the Dynamic Forward Proxy (DFP) implementation. The DFP filter allows Envoy to dynamically resolve upstream cluster hosts based on the Host header of incoming requests. When a DNS resolution completes, a callback is invoked. The flaw occurs when this callback itself triggers new DNS resolutions or removes existing pending ones, leading to a situation where the callback's context (e.g., a pointer to the resolution state) is freed while still in use.

Trigger Conditions:

1. The Dynamic Forwarding Filter is enabled.
2. The runtime flag envoy.reloadable_features.dfp_cluster_resolves_hosts is set to true.
3. The Host header is modified between the Dynamic Forwarding Filter and Router filters (e.g., via a header mutation filter).

Root Cause: The DNS resolution callback does not properly manage the lifecycle of the resolution state. When a callback is invoked, it may iterate over a list of pending resolutions. If the callback triggers a new resolution or removes an existing one, the list can be modified, causing the iterator to reference freed memory.

Impact: Abnormal process termination (crash) leading to denial of service. In a service mesh, this can cause cascading failures if the Envoy proxy crashes and is not quickly restarted.

Vulnerable vs. Patched Code

The vulnerable code is in the DFP DNS resolution callback. The patched version introduces proper reference counting and safe iteration over the pending resolutions list.

Vulnerable Code (Simplified):

void DfpCluster::onDnsResolutionComplete(const std::string& host, DnsResult result) {
  // Callback iterates over pending resolutions
  for (auto& pending : pending_resolutions_) {
    if (pending.host == host) {
      // This callback may trigger new resolutions or remove existing ones
      pending.callback(result);
      // After callback, 'pending' may be invalid if the list was modified
    }
  }
}

Patched Code (Simplified):

void DfpCluster::onDnsResolutionComplete(const std::string& host, DnsResult result) {
  // Use a shared_ptr to keep the resolution state alive
  auto resolution = findPendingResolution(host);
  if (resolution) {
    auto shared_state = resolution->state;
    // Invoke callback with a copy of the state
    resolution->callback(result);
    // The shared_ptr ensures the state is not freed prematurely
  }
}

The patch ensures that the resolution state is kept alive via a shared pointer, preventing use-after-free even if the callback modifies the pending resolutions list.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Envoy version 1.34.0-1.34.4 or 1.35.0.
• Dynamic Forwarding Filter enabled.
• Runtime flag envoy.reloadable_features.dfp_cluster_resolves_hosts set to true.
• A filter that modifies the Host header between the DFP and Router filters (e.g., a Lua filter or header mutation filter).

Exploitation Steps:

1. Deploy a vulnerable Envoy instance with the DFP filter and the runtime flag enabled.
2. Send a request with a Host header that triggers a DNS resolution.
3. Before the DNS resolution completes, modify the Host header (e.g., via a Lua filter) to a different hostname.
4. The DNS resolution callback for the original host will be invoked, but the pending resolutions list may have been modified by the new resolution request, causing a use-after-free.
5. Repeat the process to trigger a crash.

Example Request:

curl -H "Host: example.com" http://envoy-proxy:8080/

Lua Filter to Modify Host Header:

function envoy_on_request(request_handle)
  request_handle:headers():replace(":authority", "modified-host.com")
end

Blue Team

Detection:

• Monitor Envoy logs for crash dumps or segmentation faults.
• Look for repeated DNS resolution failures or timeouts.
• Use the detection rules provided below.

Mitigation:

• Immediately upgrade to Envoy 1.34.5 or 1.35.1.
• If upgrade is not possible, set the runtime flag envoy.reloadable_features.dfp_cluster_resolves_hosts to false.
• Disable the Dynamic Forwarding Filter if not required.
• Implement network segmentation to limit exposure of Envoy proxies.

Indicators of Compromise (IOCs)

• Log Entries: Envoy crash logs containing SIGSEGV or use-after-free references.
• Process Behavior: Abnormal termination of Envoy process with exit code 139 (SIGSEGV).
• Network Patterns: Repeated requests with varying Host headers targeting the DFP filter.
• File Artifacts: Core dump files in the Envoy working directory (e.g., core.12345).

Detection Engineering

YARA Rule

rule CVE_2025_54588_Envoy_UAF {
  meta:
    description = "Detects Envoy binary versions vulnerable to CVE-2025-54588"
    author = "Valters IT"
    date = "2025-04-10"
    hash = "sha256:examplehash"
  strings:
    $version_1_34 = "1.34." ascii wide
    $version_1_35 = "1.35.0" ascii wide
    $dfp_flag = "dfp_cluster_resolves_hosts" ascii wide
  condition:
    ($version_1_34 or $version_1_35) and $dfp_flag
}

Sigma Rule

title: Envoy DNS Cache Use-After-Free Crash
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects Envoy process crashes due to CVE-2025-54588
author: Valters IT
logsource:
  product: linux
  service: syslog
detection:
  selection:
    - "SIGSEGV" in message
    - "use-after-free" in message
    - "envoy" in process_name
  condition: selection
falsepositives:
  - Other memory corruption bugs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54588 Envoy DNS Cache UAF Attempt"; flow:to_server; content:"Host|3a|"; http_header; pcre:"/Host:\s*[^\r\n]+/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Envoy to version 1.34.5 or 1.35.1.
2. If upgrade is not possible, set the runtime flag envoy.reloadable_features.dfp_cluster_resolves_hosts to false in the Envoy configuration.
3. Disable the Dynamic Forwarding Filter if not required.

Long-Term Measures:

• Implement a patch management process for Envoy and other critical infrastructure components.
• Monitor Envoy security advisories and apply patches promptly.
• Use runtime security tools (e.g., Falco) to detect abnormal process terminations.
• Conduct regular security audits of Envoy configurations.

Workaround Configuration:

layered_runtime:
  layers:
    - static_layer:
        envoy.reloadable_features.dfp_cluster_resolves_hosts: false

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert