CVE-2024-4438 Overview
CVE-2024-4438 affects the etcd package distributed with the Red Hat OpenStack Platform. The package contains an incomplete fix for the HTTP/2 Rapid Reset vulnerability tracked as CVE-2023-39325 and CVE-2023-44487. The etcd binary bundles golang.org/x/net/http2 directly into its compiled artifact, rather than relying on the patched Go HTTP/2 library shipped with Red Hat Enterprise Linux. As a result, the fix must be applied at compile time, and the distributed binary remains vulnerable to denial-of-service attacks against its HTTP/2 endpoints. The flaw is categorized under [CWE-400] (Uncontrolled Resource Consumption).
Critical Impact
Remote unauthenticated attackers can exhaust server resources on exposed etcd HTTP/2 endpoints, disrupting OpenStack control plane operations.
Affected Products
- Red Hat OpenStack Platform - etcd package
- Components compiled against vulnerable golang.org/x/net/http2
- See Red Hat advisories RHSA-2024:2729, RHSA-2024:3352, and RHSA-2024:3467 for specific affected versions
Discovery Timeline
- 2024-05-08 - CVE-2024-4438 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-4438
Vulnerability Analysis
The Rapid Reset attack abuses the HTTP/2 stream cancellation mechanism. A client opens many concurrent streams and immediately sends RST_STREAM frames to cancel them. The server allocates resources for each new stream faster than it tears them down, leading to CPU and memory exhaustion. The upstream Go fix in golang.org/x/net/http2 limits the rate of concurrent stream creation and cancellation.
In this case, the etcd binary distributed with Red Hat OpenStack Platform statically vendors golang.org/x/net/http2 at build time. Even when the host operating system ships a patched Go runtime, the embedded HTTP/2 implementation inside the etcd binary remains unpatched. Rebuilding etcd against the fixed vendored library is required to remediate the issue.
Root Cause
The root cause is a build-time dependency choice. The etcd package vendored an unpatched copy of golang.org/x/net/http2 instead of consuming the HTTP/2 implementation provided by the Red Hat Enterprise Linux Go toolchain. Static linking means library-level CVE fixes do not propagate without a rebuild of the consuming binary.
Attack Vector
An unauthenticated remote attacker connects to an etcd HTTP/2 endpoint reachable over the network. The attacker initiates many HTTP/2 streams in rapid succession and sends RST_STREAM frames immediately after each request. This forces etcd to process and discard streams continuously, consuming CPU until legitimate API requests time out. The attack does not require valid credentials, user interaction, or prior access to the cluster. Successful exploitation degrades or halts the etcd key-value store, which in turn impacts dependent OpenStack control plane services.
No public proof-of-concept code is referenced for this specific CVE beyond the general Rapid Reset technique documented in the original CVE-2023-44487 disclosure.
Detection Methods for CVE-2024-4438
Indicators of Compromise
- Sudden spikes in HTTP/2 stream creation and immediate RST_STREAM frames on etcd listening ports
- Elevated CPU utilization on etcd nodes without a corresponding increase in legitimate API throughput
- etcd client timeouts, leader election churn, or OpenStack API errors tied to etcd unavailability
- Connections from unexpected source addresses to etcd peer or client ports (2379, 2380)
Detection Strategies
- Inspect HTTP/2 traffic for high ratios of RST_STREAM frames to HEADERS frames against etcd endpoints
- Audit deployed etcd binaries for the embedded golang.org/x/net/http2 version using go version -m
- Cross-reference installed package versions against the fixed releases listed in RHSA-2024:2729, RHSA-2024:3352, and RHSA-2024:3467
Monitoring Recommendations
- Track etcd metrics grpc_server_handled_total, etcd_server_proposals_failed_total, and process CPU on each member
- Alert on sustained connection storms from a single source to etcd ports
- Forward etcd and OpenStack control plane logs to a centralized SIEM for correlation with network telemetry
How to Mitigate CVE-2024-4438
Immediate Actions Required
- Apply the Red Hat updates referenced in RHSA-2024:2729, RHSA-2024:3352, and RHSA-2024:3467
- Restrict network access to etcd client and peer ports to trusted control plane subnets only
- Verify that all etcd binaries are rebuilt against a patched golang.org/x/net/http2 and not relying solely on host-level Go updates
Patch Information
Red Hat has released rebuilt etcd packages for affected Red Hat OpenStack Platform versions. Refer to the Red Hat CVE Analysis for CVE-2024-4438 and Red Hat Bug Report #2279365 for package versions and applicability.
Workarounds
- Place etcd endpoints behind a reverse proxy or load balancer that enforces HTTP/2 stream rate limits and rejects abusive RST_STREAM patterns
- Apply firewall rules to restrict access to ports 2379 and 2380 to authenticated control plane hosts
- Disable HTTP/2 on fronting proxies where feasible, falling back to HTTP/1.1 until patched binaries are deployed
# Example: restrict etcd client/peer ports to the control plane subnet
iptables -A INPUT -p tcp --dport 2379 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2380 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2379 -j DROP
iptables -A INPUT -p tcp --dport 2380 -j DROP
# Verify the embedded HTTP/2 library version in an etcd binary
go version -m /usr/bin/etcd | grep golang.org/x/net
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
