CVE-2021-43825 Use-after-free in Envoy

2022-02-2222:45:12

CWE-416

GitHub_M

www.cve.org

cve-2021-43825

envoy

use-after-free

buffer overflow

denial of service

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

40.1%

JSON

Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response is processed by the filter chain the operation may not be aborted correctly and result in accessing a freed memory block. If this happens Envoy will crash resulting in a denial of service.

CNA Affected

[
  {
    "product": "envoy",
    "vendor": "envoyproxy",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.18.6"
      },
      {
        "status": "affected",
        "version": ">= 1.19.0, < 1.19.3"
      },
      {
        "status": "affected",
        "version": ">= 1.20.0, < 1.20.2"
      },
      {
        "status": "affected",
        "version": ">= 1.21.0, < 1.21.1"
      }
    ]
  }
]