Skip to main content

Use After Free

CVE-2024-39305

High
9.1/10

Summary

Envoy is a cloud-native, open-source edge and service proxy. In envoy, references already freed memory when the route hash policy is configured with cookie attributes, which leads to Use After Free vulnerability. Note that this vulnerability has been fixed in the open as the effect would be immediately apparent if it was configured. Memory allocated for holding attribute values is freed after the configuration is parsed. During request processing, Envoy will attempt to copy content of de-allocated memory into the request cookie header. This can lead to arbitrary content of the Envoy's memory being sent to the upstream service or abnormal process termination. This vulnerability affects github.com/envoyproxy package versions 1.27.7, 1.2.8.x prior to 1.28.5, 1.29.x prior to 1.29.7, and 1.30.x prior to 1.30.4. As a workaround, do not use cookie attributes in the route action hash policy.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-416 - Use After Free

Use-after-free (UaF) vulnerability occurs when the application is using a pointer to memory that has been freed. Any attempt to read/write to a buffer after it is de-allocated allows memory corruption, sensitive information exposure, and can potentially lead to arbitrary code execution.

References

Advisory Timeline

  • Published