admin/cve
1
0
Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2025-06-19 17:30:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
cve/2024/CVE-2024-32974.md
0xMarcio 8932a8488d Update CVE sources 2024-06-08 09:32
2024-06-08 09:32:58 +00:00

1009 B
Raw Blame History

CVE-2024-32974

Description

Envoy is a cloud-native, open source edge and service proxy. A crash was observed in EnvoyQuicServerStream::OnInitialHeadersComplete() with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after StopReading() being called on the stream. As after StopReading(), the HCM's ActiveStream might have already be destroyed and any up calls from QUICHE could potentially cause use after free.

POC

Reference

Github

No PoCs found on GitHub currently.