Bug 2061638 (CVE-2022-24726)

Summary:	CVE-2022-24726 istio: Unauthenticated control plane denial of service attack due to stack exhaustion
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	agawand, jprivett, jwendell, ovanders, rcernich, security-response-team, twalsh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	istio 1.11.8, istio 1.12.5, istio 1.13.2	Doc Type:	If docs needed, set a value
Doc Text:	A stack exhaustion flaw was found in the Istio control plane. This flaw allows a remote unauthenticated attacker to send a specially crafted or oversized message to crash the control plane process, resulting in a denial of service condition.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-04-07 20:59:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2061639

Description Avinash Hanwate 2022-03-08 06:04:05 UTC

The Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message, to crash the control plane process. This can be exploited when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from an attacker.

Security advisory: https://istio.io/latest/news/security/istio-security-2022-004.

Upstream commits/PRs:
 
[master]
https://github.com/istio/istio/commit/40f6caed64e6869a5589f2e2f38f1e64063fd930

[1.11]
https://github.com/istio/istio/pull/37804
https://github.com/istio/istio/commit/458feb160756d6b38f1cee4ddb7a40ff50aaa713

[1.12]
https://github.com/istio/istio/pull/37791
https://github.com/istio/istio/commit/e9c3781bd4097f94289b18ecb5a657438f47c9a4

[1.13]
https://github.com/istio/istio/pull/37792
https://github.com/istio/istio/commit/6ca5055a4db6695ef5504eabdfde3799f2ea91fd

Comment 7 errata-xmlrpc 2022-04-07 17:59:25 UTC

This issue has been addressed in the following products:

  OpenShift Service Mesh 2.0

Via RHSA-2022:1276 https://access.redhat.com/errata/RHSA-2022:1276

Comment 8 errata-xmlrpc 2022-04-07 18:04:00 UTC

This issue has been addressed in the following products:

  OpenShift Service Mesh 2.1

Via RHSA-2022:1275 https://access.redhat.com/errata/RHSA-2022:1275

Comment 9 Product Security DevOps Team 2022-04-07 20:59:37 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-24726