- Description
- Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES). If formatting a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly continues to allocate another fixed 16KiB slice. If an attacker can trigger a statistic name longer than 16KiB—for example, by sending an HTTP or gRPC request with an extremely long request path (:path) that is recorded by the grpc_stats filter configured with stats_for_all_methods: true—the flusher will attempt to copy the metric name using memcpy operations beyond the allocated heap buffer boundaries. This leads to a heap write overflow, which can cause immediate denial-of-service (process crash) or potential remote code execution (RCE). This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
- Products
- envoy
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCF9A646-8301-48C6-9A3D-F53AFAE75C39",
"versionEndExcluding": "1.35.13",
"versionStartIncluding": "1.34.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B1146A14-3C49-48C3-BC2A-1BBB202EBD84",
"versionEndExcluding": "1.36.9",
"versionStartIncluding": "1.36.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2057BF79-00D1-4154-9DC0-3F278C72F4E1",
"versionEndExcluding": "1.37.5",
"versionStartIncluding": "1.37.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2A218AD4-BF4B-46EA-96D7-3B25B7E71AC8",
"versionEndExcluding": "1.38.3",
"versionStartIncluding": "1.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]