Описание
During an upload, curl mishandles HTTP/2 RST_STREAM received from the server
(with reason HTTP_1_1_REQUIRED or REFUSED_STREAM) leading to a use after
free of a struct Curl_easy object.
A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the client system or cause the application to crash, resulting in a Denial of Service (DoS).
Отчет
Red Hat has rated this flaw as having an Important severity because a malicious HTTP/2 server can remotely trigger memory corruption during data uploads, potentially leading to client application crashes or arbitrary code execution. While remote code execution has been demonstrated, exploitation requires strict prerequisites such as exact heap layout predictability and precise server-controlled timing, which limits broad automated exploitability. Earlier versions of Red Hat Enterprise Linux, including RHEL 8 and 9, are not vulnerable as they ship curl builds preceding the introduction of the flawed logic.
Меры по смягчению последствий
Disable HTTP/2 in curl. For the curl CLI, use the --http1.1 flag. For applications using libcurl, set CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_1_1. This vulnerability is only exploitable over HTTP/2 connections; HTTP/1.1 connections are not affected. Note that applications which depend on HTTP/2-specific features, such as gRPC, will not function with this workaround.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Confidential Compute Attestation | build-of-trustee/trustee-rhel9 | Not affected | ||
| Confidential Compute Attestation | openshift-sandboxed-containers/osc-podvm-payload-rhel9 | Not affected | ||
| Red Hat Enterprise Linux 10 | curl | Affected | ||
| Red Hat Enterprise Linux 10 | igvm | Not affected | ||
| Red Hat Enterprise Linux 10 | rust | Not affected | ||
| Red Hat Enterprise Linux 10 | s390utils | Not affected | ||
| Red Hat Enterprise Linux 10 | snphost | Not affected | ||
| Red Hat Enterprise Linux 10 | trustee | Not affected | ||
| Red Hat Enterprise Linux 6 | curl | Not affected | ||
| Red Hat Enterprise Linux 7 | curl | Not affected |
Показывать по
Дополнительная информация
Статус:
8.1 High
CVSS3
Связанные уязвимости
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from th ...
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
8.1 High
CVSS3