CVE-2024-34364: 
NixOS vulnerability analysis and mitigation

CVE-2024-34364 affects Envoy, a cloud-native, open source edge and service proxy. The vulnerability was discovered and disclosed in June 2024, exposing an out-of-memory (OOM) vector from the mirror response, as the async HTTP client buffers the response with an unbounded buffer. The affected versions include Envoy versions up to 1.27.6, 1.28.0-1.28.4, 1.29.0-1.29.5, and 1.30.0-1.30.2 (NVD).

The vulnerability stems from the async HTTP client's behavior of fully buffering mirror response messages in memory without bounds. This implementation flaw allows potential exploitation when a mirror cluster sends extremely large response messages. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) by NIST and 5.7 (Medium) by GitHub, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H. The issue affects multiple components including wasm filter, lua filter, ext_proc, oauth filter, ext_authz, jwks_fetcher, and various other Envoy components (GitHub Advisory).

The primary impact of this vulnerability is a potential denial of service condition where Envoy instances can be forced into an out-of-memory state. This occurs when a malicious backend sends extremely large responses, leading to unbounded memory consumption and eventual service disruption (GitHub Advisory).

The vulnerability requires network access and low privileges but does need user interaction for exploitation. Most auth/log related extensions assume trusted upstream, while components like wasm, lua, and ext_proc may not assume it, making them potentially more susceptible to exploitation (GitHub Advisory).

The vulnerability has been patched in versions 1.30.2, 1.29.5, 1.28.4, and 1.27.6. The fix includes disabling buffering of mirror responses and implementing a configurable hard limit for the HTTP async client. Users can set this limit through a runtime key based on their specific needs and security requirements (GitHub Advisory).