Описание
A use-after-free vulnerability exists in libcurl when an application
configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or
CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and
finally terminates the handle with curl_easy_cleanup(). During this final
cleanup phase, libcurl attempts to access and modify an internal structure
that was already freed during the reset operation.
A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving curl_easy_reset() and curl_easy_cleanup(). During the final cleanup, libcurl attempts to access memory that has already been released. This can lead to application crashes, resulting in a Denial of Service (DoS).
Отчет
This Moderate impact use-after-free flaw in libcurl can lead to application crashes and Denial of Service. It occurs when an application specifically configures an HTTP/2 stream-dependency tree and then performs a precise sequence of curl_easy_reset() and curl_easy_cleanup() operations, attempting to access already freed memory. This vulnerability requires a specific application programming pattern, limiting its exploitability in typical Red Hat deployments.
Меры по смягчению последствий
To mitigate this issue, avoid configuring HTTP/2 stream dependencies within applications utilizing libcurl. This functionality is considered deprecated and its use is required to trigger the vulnerability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Confidential Compute Attestation | build-of-trustee/trustee-rhel9 | Not affected | ||
| Confidential Compute Attestation | openshift-sandboxed-containers/osc-podvm-payload-rhel9 | Not affected | ||
| Red Hat Enterprise Linux 10 | curl | Affected | ||
| Red Hat Enterprise Linux 10 | igvm | Affected | ||
| Red Hat Enterprise Linux 10 | rust | Affected | ||
| Red Hat Enterprise Linux 10 | s390utils | Not affected | ||
| Red Hat Enterprise Linux 10 | snphost | Affected | ||
| Red Hat Enterprise Linux 10 | trustee | Affected | ||
| Red Hat Enterprise Linux 10 | trustee-guest-components | Not affected | ||
| Red Hat Enterprise Linux 6 | curl | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
4.7 Medium
CVSS3
Связанные уязвимости
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.
A use-after-free vulnerability exists in libcurl when an application c ...
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.
EPSS
4.7 Medium
CVSS3