Description
Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the stream. As after `StopReading()`, the HCM's `ActiveStream` might have already be destroyed and any up calls from QUICHE could potentially cause use after free.
Remediation
References
Related Vulnerabilities
Internet Information Services CVE-2002-1790 Vulnerability (CVE-2002-1790)
WordPress Plugin MapSVG Lite Arbitrary File Upload (4.0.5)
Magento Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-7874)
Resin Application Server Other Vulnerability (CVE-2012-2967)
Oracle HTTP Server NULL Pointer Dereference Vulnerability (CVE-2020-1971)