Attack type

Remote

Impact

Denial of Service (crash)

Affected component(s)

HTTP processing, when internal redirects are configured.

Attack vector(s)

Remote

Discoverer(s)/Credits

Artur Molchanov arturmolchanov@gmail.com

Description (brief; included in CVE)

Envoy internal redirects for requests with bodies or trailers are not safe if the redirect prompts an Envoy-generated local reply.

Example exploit or proof-of-concept

An example of when Envoy would send a local reply for internal redirects: if a client sends a non-headers-only request which results in a redirect, and the request redirects to a route configured for local replies, Envoy will send the local reply on processing the redirect headers. Due to a bug in the redirect logic, on sending that local reply, Envoy will attempt to reset the (completed, and deleted) downstream stream.

Description (full; not included in CVE but will be published on GitHub later and linked)

If Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, there’s a lifetime bug which can be triggered. If while replaying the request Envoy sends a local reply when the redirect headers are processed, the downstream state indicates that the downstream stream is not complete. On sending the local reply, Envoy will attempt to reset the upstream stream, but as it is actually complete, and deleted, this result in a use-after-free.

Mitigation

Disable internal redirects if crashes are observed.

Detection

Crashes with recreateStream in the call stack