CVE-2024-32975: 
NixOS vulnerability analysis and mitigation

Envoy, a cloud-native open source edge and service proxy, was found to contain a vulnerability identified as CVE-2024-32975. The vulnerability manifests as a crash at QuicheDataReader::PeekVarInt62Length(), which is caused by an integer underflow in the QuicStreamSequencerBuffer::PeekRegion() implementation. This vulnerability affects multiple versions of Envoy including versions prior to 1.30.2, 1.29.5, 1.28.4, and 1.27.6 (GitHub Advisory).

The vulnerability occurs when QUIC stream buffers accumulate nearly 64MB of request/response data in its circular receive buffer before pushing data to the decoder. The excessive buffering is attributed to head of line blocking in Qpack decoding in QUICHE or slow Envoy decoding pipeline. The receive buffer operates as a circular buffer consisting of 1024 memory blocks of 8KB each. The issue manifests when access to the receive buffer is located in the same memory block where the last received byte lands, resulting in incorrect calculation of the peeked memory length with a lower end offset - higher start offset, leading to integer underflow. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH by NVD and 5.9 MEDIUM by GitHub (NVD).

The vulnerability affects Envoy users who have configured HTTP/3 upstream or downstream services. When exploited, it can cause a crash in the service, potentially leading to service disruption and availability issues (GitHub Advisory).

The vulnerability can be exploited by sending a large POST request (>128MB) that references a request header in Qpack dynamic table, without sending Qpack table update instructions. After the stream gets flow control blocked, sending the Qpack table update triggers the vulnerability (GitHub Advisory).

The vulnerability has been patched in multiple versions of Envoy. Users should upgrade to version 1.30.2, 1.29.5, 1.28.4, or 1.27.6 depending on their current version track (GitHub Advisory).