bind_to_port: false on a UDP/QUIC listener crashes Envoy

Originally reported by @filipcacky

Crash on startup with specific config. Ok to fix in the open.

Summary

bind_to_port: false on a UDP/QUIC listener crashes Envoy due to nullptr dereference.

Doesn't look exploitable to me, but i lack imagination and the PR template is clear on "fixing any crash". I'll fix it in the clear if you think this is a non-issue.

Details

No-bind UDP/QUIC listeners get a null io_handle, applying socket options then dereferences it in SocketImpl::setSocketOption which causes a segfault.

Caught Segmentation fault: 11, suspect faulting address 0x0                                                                                                                                               
#0: Envoy::Network::SocketOptionImpl::setOption()
#1: Envoy::Server::ListenSocketFactoryImpl::createListenSocketAndApplyOptions()
#2: Envoy::Server::ListenSocketFactoryImpl::ListenSocketFactoryImpl()
#3: Envoy::Server::ListenSocketFactoryImpl::create()
#4: Envoy::Server::ListenerManagerImpl::createListenSocketFactory()
#5: Envoy::Server::ListenerManagerImpl::setNewOrDrainingSocketFactory()
#6: Envoy::Server::ListenerManagerImpl::addOrUpdateListenerInternal()
#7: Envoy::Server::ListenerManagerImpl::addOrUpdateListener()
#8: Envoy::Server::Configuration::MainImpl::initialize()
#9: Envoy::Server::InstanceBase::initializeOrThrow()
#10: Envoy::Server::InstanceBase::initialize()
...

PoC

static_resources:
  listeners:
  - name: listener
    address:
      socket_address:
        address: 127.0.0.1
        port_value: 4443
        protocol: UDP
    bind_to_port: false
    udp_listener_config:
      quic_options: {}
    filter_chains:
    - transport_socket:
        name: envoy.transport_sockets.quic
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.quic.v3.QuicDownstreamTransport
          downstream_tls_context:
            common_tls_context:
              tls_certificates:
              - certificate_chain:
                  filename: ./test/config/integration/certs/servercert.pem
                private_key:
                  filename: ./test/config/integration/certs/serverkey.pem
      filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          codec_type: HTTP3
          stat_prefix: prefix
          route_config:
            virtual_hosts:
            - name: default
              domains: ["*"]
              routes:
              - match:
                  prefix: "/"
                direct_response:
                  status: 200

Impact

Anyone able to add/update a listener can crash Envoy.