| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/envoyproxy/envoy | ≥ 1.34.0, < 1.34.5≥ 1.35.0, < 1.35.1 | 1.34.51.35.1 |
| envoy | = 1.35.0≥ 1.34.0, < 1.34.5 | 1.34.5 |
A use-after-free (UAF) vulnerability in Envoy's DNS cache causes abnormal process termination. Envoy may reallocate memory when processing a pending DNS resolution, causing list iterator to reference freed memory.
The vulnerability exists in Envoy's Dynamic Forward Proxy implementation starting from version v1.34.0. The issue occurs when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur in the following configuration:
envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag is enabled.Denial of service due to abnormal process termination.
Request to Envoy configured as indicated above.
Users should upgrade to v1.35.1 or v1.34.5.
Set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false.
Abnormal process termination with the Envoy::Event::DispatcherImpl::runPostCallbacks() frame in the call stack.
Rohit Agrawal (agrawroh) ([email protected])
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free