« Volver al listado

CVE-2024-32974

Estado: ModificadaAlta (7.5)—

Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the stream. As after `StopReading()`, the HCM's `ActiveStream` might have already be destroyed and any up calls from QUICHE could potentially cause use after free.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Envoyproxy — Envoy

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32974",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32974",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-19T18:30:05.375686Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "envoyproxy",
          "product": "envoy",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.30.0, <= 11.30.1"
            },
            {
              "status": "affected",
              "version": ">= 1.29.0, <= 1.29.4"
            },
            {
              "status": "affected",
              "version": ">= 1.28.0, <= 1.28.3"
            },
            {
              "status": "affected",
              "version": "<= 1.27.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-06-04T21:15:33.773",
  "references": [
    {
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-mgxp-7hhp-8299",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-mgxp-7hhp-8299",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the stream. As after `StopReading()`, the HCM's `ActiveStream` might have already be destroyed and any up calls from QUICHE could potentially cause use after free. \n"
    },
    {
      "lang": "es",
      "value": "Envoy es un proxy de servicio y borde de código abierto, nativo de la nube. Se observó un bloqueo en `EnvoyQuicServerStream::OnInitialHeadersComplete()` con la siguiente pila de llamadas. Es un use-after-free causado porque QUICHE continúa enviando encabezados de solicitud después de que se llama a `StopReading()` en la secuencia. Al igual que después de `StopReading()`, es posible que el `ActiveStream` del HCM ya se haya destruido y cualquier llamada desde QUICHE podría provocar su use after free."
    }
  ],
  "lastModified": "2026-06-17T07:30:48.100",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1020E2E2-EDFA-4188-B17F-406904256EB1",
              "versionEndExcluding": "1.27.6"
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5107DA5-4BC7-4AB8-8087-0DA20021D0B0",
              "versionEndExcluding": "1.28.4",
              "versionStartIncluding": "1.28.0"
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34583FBC-8B38-4BBB-9E3B-7731272C0A6F",
              "versionEndExcluding": "1.29.5",
              "versionStartIncluding": "1.29.0"
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65C0355B-7FAC-4417-B707-A3CA494C20A0",
              "versionEndExcluding": "1.30.2",
              "versionStartIncluding": "1.30.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}