CVE-2024-23322: Envoyproxy Envoy DoS Vulnerability

CVE-2024-23322 Overview

CVE-2024-23322 is a denial-of-service vulnerability in Envoy, a high-performance edge, middle, and service proxy widely deployed in cloud-native and service mesh architectures. The flaw causes Envoy to crash when specific timeout conditions overlap during request handling. Exploitation requires the proxy to be configured with hedge_on_per_try_timeout and per_try_idle_timeout enabled, and a per_try_timeout value within the backoff interval of the idle timeout. When these timers race, the routing filter dereferences invalid state, producing a use-after-free condition tracked as [CWE-416]. Remote attackers can trigger the crash by sending requests that exercise the affected timeout paths.

Critical Impact
A network-reachable attacker can crash Envoy proxy instances without authentication, disrupting all traffic routed through the affected proxy.

Affected Products

Envoy versions prior to 1.26.7
Envoy 1.27.x prior to 1.27.3 and 1.28.x prior to 1.28.1
Envoy 1.29.x prior to 1.29.1

Discovery Timeline

2024-02-09 - CVE-2024-23322 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-23322

Vulnerability Analysis

The vulnerability resides in Envoy's HTTP router filter, which manages retry and hedging logic for upstream requests. When hedge_on_per_try_timeout is enabled, Envoy issues parallel hedged requests instead of canceling the original after a per-try timeout. The bug arises when the per_try_timeout and per_try_idle_timeout fire within the same backoff interval, leaving timer state inconsistent. The router accesses freed or stale UpstreamRequest references, terminating the process. Because Envoy fronts production traffic in mesh and ingress deployments, a crash interrupts every connection multiplexed through the instance.

Root Cause

The two timers in source/common/router/upstream_request.cc were not mutually disarmed. When onPerTryIdleTimeout() and onPerTryTimeout() executed near-simultaneously, one callback could re-arm or invoke logic against state already released by the other, producing a use-after-free.

Attack Vector

An unauthenticated remote attacker sends HTTP requests that include or align with timeout-relevant headers. If the operator has enabled hedged retries and idle per-try timers, the attacker can race the timers by stalling the upstream response or by setting the x-envoy-upstream-rq-per-try-timeout-ms header to a value within the idle backoff window. The exploit requires no privileges and no user interaction.

text

// Patch in source/common/router/upstream_request.cc
void UpstreamRequest::onPerTryIdleTimeout() {
  ENVOY_STREAM_LOG(debug, "upstream per try idle timeout", *parent_.callbacks());
+  if (per_try_timeout_) {
+    // Disable the per try idle timer, so it does not trigger further retries
+    per_try_timeout_->disableTimer();
+  }
  stream_info_.setResponseFlag(StreamInfo::CoreResponseFlag::StreamIdleTimeout);
  parent_.onPerTryIdleTimeout(*this);
}

void UpstreamRequest::onPerTryTimeout() {
+  if (per_try_idle_timeout_) {
+    // Delete the per try idle timer, so it does not trigger further retries.
+    // The timer has to be deleted to prevent data flow from re-arming it.
+    per_try_idle_timeout_.reset();
+  }
  if (!parent_.downstreamResponseStarted()) {

Source: Envoy commit 843f9e6. The patch disables and resets the opposing timer to prevent re-arming after release.

Detection Methods for CVE-2024-23322

Indicators of Compromise

Unexpected Envoy process termination or restart events without a corresponding configuration change or signal.
Crash backtraces referencing Router::Filter::onSoftPerTryTimeout or UpstreamRequest::onPerTryTimeout.
Spikes in upstream StreamIdleTimeout response flags immediately preceding a proxy restart.

Detection Strategies

Inspect Envoy access logs for repeated requests carrying x-envoy-upstream-rq-per-try-timeout-ms values that align with configured idle timeout backoffs.
Correlate Envoy server.live and server.uptime statistics with upstream request timeout counters to detect crash patterns.
Audit Envoy route configurations for combined use of hedge_on_per_try_timeout, per_try_idle_timeout, and per_try_timeout to identify exposed clusters.

Monitoring Recommendations

Alert on Envoy worker restarts, segmentation faults, and SIGABRT exits in container orchestration logs.
Track the cluster.upstream_rq_per_try_timeout and cluster.upstream_rq_per_try_idle_timeout Prometheus counters for unusual ratios.
Forward Envoy crash dumps and stderr to a centralized logging pipeline for retrospective analysis.

How to Mitigate CVE-2024-23322

Immediate Actions Required

Upgrade Envoy to 1.29.1, 1.28.1, 1.27.3, or 1.26.7, depending on the deployed release branch.
Inventory all service mesh control planes (Istio, Consul, Gloo) and confirm the bundled Envoy data plane is patched.
Restrict who can set x-envoy-upstream-rq-per-try-timeout-ms on inbound traffic until proxies are updated.

Patch Information

The fix is committed in Envoy commit 843f9e6a and detailed in GitHub Security Advisory GHSA-6p83-mfmh-qv38. The patch disables the opposing timer inside both onPerTryIdleTimeout() and onPerTryTimeout() to prevent re-entry against released state.

Workarounds

The vendor states there are no known workarounds; upgrading is required.
As a temporary risk reduction, operators may disable hedge_on_per_try_timeout or remove per_try_idle_timeout from cluster configurations until patching completes.

bash

# Verify the running Envoy version on a host or container
envoy --version

# Example route configuration to audit and remove the vulnerable combination
# until upgrade is complete
# route:
#   cluster: my_service
#   retry_policy:
#     retry_on: 5xx
#     hedge_on_per_try_timeout: true   # disable as temporary mitigation
#     per_try_timeout: 0.200s
#   per_try_idle_timeout: 0.200s        # remove as temporary mitigation