IM
IronMonkey Threat Research

CVE-2021-22901 HIGH

Published: 2021-06-11 | Last Modified: 2026-10-08 | Status: Modified

Description

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.

Additional Descriptions (1)

curl versiones 7.75.0 hasta 7.76.1 sufre de una vulnerabilidad de uso de la memoria previamente liberada que resulta en el uso de memoria ya liberada cuando un ticket de sesión TLS 1.3 llega a través de una conexión. Un servidor malicioso puede usar esto en raras circunstancias desafortunadas para alcanzar potencialmente la ejecución de código remota en el cliente. Cuando libcurl en tiempo de ejecución configura el soporte para tickets de sesión TLS 1.3 en una conexión usando OpenSSL, almacena punteros al objeto de transferencia en memoria para su posterior recuperación cuando llega un ticket de sesión. Si la conexión es usada por múltiples transferencias (como en el caso de una conexión HTTP/1.1 reutilizada o una conexión HTTP/2 multiplexada) ese primer objeto de transferencia podría ser liberado antes de que se establezca la nueva sesión en esa conexión y entonces la función accederá a un búfer de memoria que podría ser liberado. Al utilizar esa memoria, libcurl podría incluso llamar a un puntero de función en el objeto, haciendo posible una ejecución de código remota si el servidor pudiera de alguna manera conseguir el contenido de la memoria diseñada en el lugar correcto de la memoria

CVSS Metrics

Base Score: 8.1 (HIGH)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.2

Impact Score: 5.9

Base Score: 6.8 (MEDIUM)

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 6.4

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-416
[email protected] Primary
en CWE-416

Affected Products

Vendor Product Version Update Type
haxx curl * <built-in method update of dict object at 0x7fd31b227c40> Application
oracle communications_cloud_native_core_binding_support_function 1.11.0 <built-in method update of dict object at 0x7fd384a66940> Application
oracle communications_cloud_native_core_network_function_cloud_native_environment 1.10.0 <built-in method update of dict object at 0x7fd39c4ead00> Application
oracle communications_cloud_native_core_network_repository_function 1.15.0 <built-in method update of dict object at 0x7fd340cc6900> Application
oracle communications_cloud_native_core_network_repository_function 1.15.1 <built-in method update of dict object at 0x7fd384a64840> Application
oracle communications_cloud_native_core_network_slice_selection_function 1.8.0 <built-in method update of dict object at 0x7fd384a66b40> Application
oracle communications_cloud_native_core_service_communication_proxy 1.15.0 <built-in method update of dict object at 0x7fd3695db600> Application
oracle essbase * <built-in method update of dict object at 0x7fd39c4ebbc0> Application
oracle essbase * <built-in method update of dict object at 0x7fd39c4e5b80> Application
oracle mysql_server * <built-in method update of dict object at 0x7fd384a67b40> Application
oracle mysql_server * <built-in method update of dict object at 0x7fd340b01980> Application
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd36b44a340> Application
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd34b9a7600> Application
netapp cloud_backup - <built-in method update of dict object at 0x7fd340acab00> Application
netapp oncommand_insight - <built-in method update of dict object at 0x7fd340b00180> Application
netapp oncommand_workflow_automation - <built-in method update of dict object at 0x7fd340b01300> Application
netapp snapcenter - <built-in method update of dict object at 0x7fd384a66bc0> Application
netapp solidfire\,_enterprise_sds_\&_hci_storage_node - <built-in method update of dict object at 0x7fd340af73c0> Application
netapp solidfire_\&_hci_management_node - <built-in method update of dict object at 0x7fd340cc5780> Application
netapp solidfire_baseboard_management_controller_firmware - <built-in method update of dict object at 0x7fd340ac88c0> Operating System
netapp hci_compute_node_firmware - <built-in method update of dict object at 0x7fd340cc5940> Operating System
netapp h300e_firmware - <built-in method update of dict object at 0x7fd36b448680> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd3848e3040> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd3695daa40> Operating System
netapp h500e_firmware - <built-in method update of dict object at 0x7fd369a4d8c0> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd39c4e6900> Operating System
netapp h700e_firmware - <built-in method update of dict object at 0x7fd2dbcde100> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd340b01280> Operating System
siemens sinec_infrastructure_network_services * <built-in method update of dict object at 0x7fd34088d980> Application
splunk universal_forwarder * <built-in method update of dict object at 0x7fd341efab80> Application
splunk universal_forwarder * <built-in method update of dict object at 0x7fd2d399a800> Application
splunk universal_forwarder 9.1.0 <built-in method update of dict object at 0x7fd39c40b000> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.15.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:essbase:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
Yes cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
Yes cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

References