PT-2022-19478 · Envoy · Envoy

Artur Molchanov · Published 2022-06-09 · Updated 2024-03-06 · CVE-2022-29227

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.22.1

Description The issue is related to a lifetime bug that can be triggered when Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers. If Envoy sends a local reply when the redirect headers are processed, the downstream state indicates that the downstream stream is not complete, leading to a use-after-free error when Envoy attempts to reset the upstream stream.

Recommendations For versions prior to 1.22.1, upgrade to version 1.22.1 or later to resolve the issue. If upgrading is not possible, disable internal redirects to minimize the risk of crashes.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BIT-ENVOY-2022-29227

CVE-2022-29227

GHSA-RM2P-QVF6-PVR6

Affected Products

Envoy

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29227.json · Exploit
• https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29227 · Security Note
• https://osv.dev/vulnerability/BIT-envoy-2022-29227 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9586.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9588.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9587.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29227 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9589.html · Vendor Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-rm2p-qvf6-pvr6 · Note
• https://t.me/cibsecurity/44152 · Telegram Post