CVE-2020-15127: 
NixOS vulnerability analysis and mitigation

A denial of service (DOS) vulnerability was discovered in Contour's deployment of Envoy (CVE-2020-15127) affecting versions before 1.7.0. The vulnerability was identified in August 2020, impacting the ingress data plane of Kubernetes clusters. This vulnerability exists in the shutdown manager's endpoint implementation, where GET requests to /shutdown on port 8090 of the Envoy pod could initiate Envoy's shutdown procedure without proper authentication (GitHub Advisory).

The vulnerability stems from an unauthenticated access to the shutdown manager's endpoint on port 8090. When Envoy is running with host network access (pod spec hostNetwork=true), the shutdown endpoint becomes accessible to anyone who can reach the Kubernetes node running Envoy. The shutdown procedure, when triggered, flips the readiness endpoint to false, removing Envoy from the routing pool. This vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network accessibility with no required privileges or user interaction (NVD).

The successful exploitation of this vulnerability allows malicious actors to shut down all instances of Envoy, effectively disabling the entire ingress data plane. This can result in a complete denial of service for the cluster's ingress traffic management system (GitHub Advisory).

The vulnerability is easily exploitable through network access. An attacker only needs to be able to reach the Kubernetes node running Envoy and send GET requests to the /shutdown endpoint on port 8090. No authentication or special privileges are required for exploitation (GitHub Advisory).

The vulnerability was fixed in Contour version 1.7.0. The fix involves modifying the preStop lifecycle hook to use a command instead of an HTTP request. The /shutdown endpoint was redesigned to only return when the pod is ready to be terminated, and no longer initiates the Envoy shutdown sequence directly. The fix implements a file messaging pattern to control when it is safe for Envoy to terminate. Users are strongly advised to upgrade to version 1.7.0 or later, as there are no known workarounds for this vulnerability (GitHub Release, GitHub Advisory).