Use-After-Free Vulnerability in curl
Summary
CVE-2021-22901: curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. Affects curl across 2 version ranges.
< 7.77.0-r0
< 7f4a9a9b2a49547eae24d2e19bc5c346e9026479
Fixed in 7.77.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
curl is a command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. The vulnerability affects versions 7.75.0 through 7.76.1 of curl. This vulnerability allows a malicious server to exploit a use-after-free vulnerability in the client, potentially leading to remote code execution. The vulnerability occurs when a TLS 1.3 session ticket arrives over a connection, and already freed memory is used. This can occur in rare circumstances and can be exploited by the server to execute arbitrary code on the client.
Vulnerability Detail
The use-after-free vulnerability in curl occurs when a TLS 1.3 session ticket arrives over a connection, and already freed memory is used. This can happen when libcurl sets up support for TLS 1.3 session tickets on a connection using OpenSSL. Pointers to the transfer in-memory object are stored for later retrieval when a session ticket arrives. However, if the connection is used by multiple transfers, the first transfer object might be freed before the new session is established, leading to accessing a freed memory buffer. This can result in remote code execution if the server can craft memory content in the correct place.
How To Fix
Minimum fixed version
7.77.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update curl to the fixed version as soon as possible.
Conclusion
The use-after-free vulnerability in curl can be exploited by a malicious server to potentially execute arbitrary code on the client. It is crucial to update curl to version 7.77.0-r0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
curl is a command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more.
Versions 7.75.0 through 7.76.1 of curl are affected by this vulnerability.
A malicious server can exploit this vulnerability by sending a TLS 1.3 session ticket over a connection, causing already freed memory to be used. This can potentially lead to remote code execution on the client.
Yes, a fix is available in version 7.77.0-r0 of curl. It is recommended to update to this version or later to mitigate the vulnerability.
There are no known workarounds for this vulnerability. Updating to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
