CVE-2024-6197 Affecting curl package, versions <8.9.1-2ubuntu1


Severity

Recommended
medium

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.07% (32nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2410-CURL-8190078
  • published15 Oct 2024
  • disclosed24 Jul 2024

Introduced: 24 Jul 2024

CVE-2024-6197  (opens in a new tab)

How to fix?

Upgrade Ubuntu:24.10 curl to version 8.9.1-2ubuntu1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. See How to fix? for Ubuntu:24.10 relevant fixed versions and status.

libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes free() on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the free() implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.

CVSS Scores

version 3.1