CVE-2020-10739 (C++, published 2020-06-02T13:15Z)
Description: value: Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet, an attacker could trigger a Null Pointer Exception resulting in a Denial of Service. This could be sent to the ingress gateway or a sidecar, triggering a null pointer exception which results in a denial of service. This also affects servicemesh-proxy where a null pointer exception flaw was found in servicemesh-proxy. When running Telemetry v2 (not on by default in version 1.4.x), an attacker could send a specially crafted packet to the ingress gateway or proxy sidecar, triggering a denial of service.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/istio/envoy
Files changed:
source/extensions/common/wasm/wasm.cc
source/extensions/common/wasm/wasm.h
test/extensions/wasm/wasm_test.cc
Commit message: 1.4 - Do not call into the VM unless the VM Context has been created. (#24)

* Ensure that the in VM Context is created before onDone is called.

Signed-off-by: John Plevyak <jplevyak@gmail.com>

* Update as per offline discussion.

Signed-off-by: John Plevyak <jplevyak@gmail.com>

* Set in_vm_context_created_ in onNetworkNewConnection.

Signed-off-by: John Plevyak <jplevyak@gmail.com>

* Add guards to other network calls.

Signed-off-by: John Plevyak <jplevyak@gmail.com>

* Fix common/wasm tests.

Signed-off-by: John Plevyak <jplevyak@gmail.com>

* Patch tests.

Signed-off-by: John Plevyak <jplevyak@gmail.com>

* Remove unecessary file from cherry-pick.

Signed-off-by: John Plevyak <jplevyak@gmail.com>

Vulnerable code:
  if (!wasm_->onDownstreamData_) {
  if (!wasm_->onUpstreamData_) {
  if (wasm_->onDownstreamConnectionClose_) {
  if (wasm_->onUpstreamConnectionClose_) {
  if (!wasm_->onRequestBody_) {
  if (!wasm_->onRequestTrailers_) {
  if (!wasm_->onRequestMetadata_) {
  if (!wasm_->onResponseBody_) {
  if (!wasm_->onResponseTrailers_) {
  if (!wasm_->onResponseMetadata_) {
  if (wasm_->onDone_) {
  if (wasm_->onLog_) {
  if (wasm_->onDelete_) {
  wasm->setContext(context.get());

Fixed code:
  in_vm_context_created_ = true;
  in_vm_context_created_ = true;
  if (!in_vm_context_created_ || !wasm_->onDownstreamData_) {
  if (!in_vm_context_created_ || !wasm_->onUpstreamData_) {
  if (in_vm_context_created_ && wasm_->onDownstreamConnectionClose_) {
  if (in_vm_context_created_ && wasm_->onUpstreamConnectionClose_) {
  if (!in_vm_context_created_ || !wasm_->onRequestBody_) {
  if (!in_vm_context_created_ || !wasm_->onRequestTrailers_) {
  if (!in_vm_context_created_ || !wasm_->onRequestMetadata_) {
  if (!in_vm_context_created_ || !wasm_->onResponseBody_) {
  if (!in_vm_context_created_ || !wasm_->onResponseTrailers_) {
  if (!in_vm_context_created_ || !wasm_->onResponseMetadata_) {
  if (in_vm_context_created_ && wasm_->onDone_) {
  if (in_vm_context_created_ && wasm_->onLog_) {
  if (in_vm_context_created_ && wasm_->onDelete_) {
  void setInVmContextCreatedForTesting() { in_vm_context_created_ = true; }

  context->setInVmContextCreatedForTesting();
  context->setInVmContextCreatedForTesting();