Description
Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the stream. As after `StopReading()`, the HCM's `ActiveStream` might have already be destroyed and any up calls from QUICHE could potentially cause use after free.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| envoyproxy | envoy | >= 1.30.0, <= 1.30.1, >= 1.29.0, <= 1.29.4, >= 1.28.0, <= 1.28.3, <= 1.27.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ecs-service-connect-agent | v1.29.5.0-1.amzn2023 | ALAS2023-2024-647 |
Advisories 1
- ALAS2023-2024-647 Important: ecs-service-connect-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 17, 2024