Skip to main content

NULL Pointer Dereference

CVE-2024-53270

Severity High
Score 7.5/10

Summary

Envoy is a cloud-native, high-performance edge/middle/service proxy. In affected versions, `sendOverloadError` is going to assume the active request exists when `envoy.load_shed_points.http1_server_abort_dispatch` is configured. If `active_request` is `nullptr`, only `onMessageBeginImpl()` is called. However, the `onMessageBeginImpl` will directly return ok status if the stream is already reset, leading to the `nullptr` reference. The downstream reset can actually happen during the H/2 upstream reset. As a result, Envoy may crash. Users unable to upgrade may disable the `http1_server_abort_dispatch` load shed point and/or use a high threshold. This issue affects the package versions github.com/envoyproxy/envoy prior to 1.29.12, 1.30.x prior to 1.30.9, 1.31.x prior to 1.31.5, and 1.32.x prior to 1.32.3.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-476 - NULL Pointer Dereference

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Advisory Timeline

  • Published