GHSA-cf3q-gqg7-3fm9
Envoy crashes when HTTP ext_proc processes local replies
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/envoyproxy/envoy | < 1.30.10 | 1.30.10 |
| Go | github.com/envoyproxy/envoy | >= 1.31.0, < 1.31.6 | 1.31.6 |
| Go | github.com/envoyproxy/envoy | >= 1.32.0, < 1.32.4 | 1.32.4 |
| Go | github.com/envoyproxy/envoy | >= 1.33.0, < 1.33.1 | 1.33.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the fail of a websocket handshake will trigger a local reply leading to the crash of Envoy.
### PoC
If both websocket and ext_proc are enabled, a failed handshake will trigger a local reply, thus ext_proc will crash.
### Mitigation
1. Disable websocket traffic
2. Change the websocket response from backend to always return `101 Switch protocol` based on RFC.
3. Apply the patch and the ext_proc filter will not send the local reply that is generated by Envoy to the ext_proc server for processing.
4. Apply the patch that the router will cancel the upstream requests when sending a local reply.
### Impact
Denial of service
### Reporter
Vasilios Syrakis
Fernando Cainelli
References
External links from the advisory. They lead to third-party sites.