Critical Use-After-Free Vulnerability in curl Package
Summary
ALPINE-CVE-2021-22901: curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. Affects curl versions < 7.77.0-r0. Fixed in 7.77.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and more. curl is integral for developers and system administrators for tasks such as file transfers, API interactions, and web scraping. However, certain versions of curl are vulnerable to a use-after-free issue that can lead to severe security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2021-22901, affects curl versions 7.75.0 through 7.76.1. It arises when a TLS 1.3 session ticket is received over a reused connection. In this scenario, pointers to the transfer in-memory object are stored for later use. If the connection is shared among multiple transfers, the first transfer object may be freed before the new session is established, leading to the potential use of freed memory. This could allow a malicious server to execute arbitrary code on the client, posing a significant security threat.
How To Fix
Minimum fixed version
7.77.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid reusing connections for multiple transfers when using TLS 1.3 session tickets. This can help prevent the use-after-free condition until the package is updated.
Conclusion
The CVE-2021-22901 vulnerability in the curl package poses a significant risk due to its potential for remote code execution. Users are strongly advised to update to the patched version 7.77.0-r0 or later to protect their systems. Temporary workarounds can help mitigate the risk until the update is applied.
See every vulnerability recorded for curl →
FAQ
CVE-2021-22901 is a critical vulnerability in the curl package that allows for potential remote code execution due to a use-after-free error.
curl versions 7.75.0 through 7.76.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2021-22901 is 8.1, indicating a high severity level.
If you cannot update curl right away, avoid reusing connections for multiple transfers to mitigate the risk until an update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
