CVE-2022-23606
Crash when a cluster is deleted in Envoy
In short
Envoy crashes when a cluster with many idle connections is deleted because of infinite recursion in the disconnection process. This causes the proxy to stop working unexpectedly.
Technical detail
When a cluster is removed via CDS, Envoy's idle connection disconnection procedure triggers unbounded recursion, exhausting the stack and terminating the process. Attack vector is administrative (cluster deletion); impact is denial of service affecting all traffic through that cluster.
Summary generated and translated by AI from the official description.
Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected products
envoyproxy · envoyWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →