CVE-2020-10739: 
Istio Control Plane (istiod) vulnerability analysis and mitigation

A vulnerability (CVE-2020-10739) was discovered in Istio versions 1.4.x before 1.4.9 and 1.5.x before 1.5.4 when telemetry v2 is enabled. The vulnerability allows an attacker to trigger a Null Pointer Exception by sending specially crafted packets to the ingress gateway or sidecar, resulting in a Denial of Service condition. The vulnerability was disclosed on May 12, 2020, and received a CVSS v3.1 base score of 7.5 (HIGH) (Istio Advisory, NVD).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) that occurs when telemetry v2 is enabled. The issue stems from the system attempting to call into the VM before the VM Context has been properly created. The technical fix involved adding guards to ensure that the in_vm_context_created_ flag is properly set before making calls to the VM, particularly in network-related operations and various HTTP filter status checks (GitHub Patch).

When exploited, this vulnerability can result in a denial of service condition affecting the ingress gateway or proxy sidecar. The impact is particularly severe as it affects the availability of services without requiring authentication (CVSS metrics: Network Vector, Low Attack Complexity, No Privileges Required, No User Interaction) (Red Hat Advisory).

The vulnerability can be exploited remotely without requiring authentication. An attacker only needs to send specially crafted packets to the ingress gateway or sidecar to trigger the null pointer exception. The attack vector is particularly concerning as it requires low complexity to execute (NVD).

Two primary mitigation options are available: 1) Upgrade to Istio versions 1.4.9 or later for 1.4.x deployments, or 1.5.4 or later for 1.5.x deployments. 2) As a workaround, users can disable telemetry v2 by running the command: istioctl manifest apply --set values.telemetry.v2.enabled=false. For version 1.4.x, telemetry v2 is not enabled by default, which provides some natural mitigation (Istio Advisory).

The vulnerability was responsibly disclosed by Joren Zandstra and addressed by the Envoy Security Team. Red Hat classified this as an Important security issue and provided fixes through their OpenShift Service Mesh 1.1.2 update (Red Hat Bugzilla).