IM
IronMonkey Threat Research

CVE-2023-27537 MEDIUM

Published: 2023-03-30 | Last Modified: 2024-11-21 | Status: Modified

Description

A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread locks, two threads sharing the same HSTS data could end up doing a double-free or use-after-free.

CVSS Metrics

Base Score: 5.9 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.2

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-415
[email protected] Primary
en CWE-415

Affected Products

Vendor Product Version Update Type
haxx libcurl 7.88.0 <built-in method update of dict object at 0x7fd2a28b2780> Application
haxx libcurl 7.88.1 <built-in method update of dict object at 0x7fd2a28b1f80> Application
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd3408f3980> Application
netapp clustered_data_ontap 9.0 <built-in method update of dict object at 0x7fd369a099c0> Application
broadcom brocade_fabric_operating_system_firmware - <built-in method update of dict object at 0x7fd2a28b03c0> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd2a28b1140> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd369a09140> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd3841f0540> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd369a0bcc0> Operating System
splunk universal_forwarder * <built-in method update of dict object at 0x7fd2a28b3340> Application
splunk universal_forwarder * <built-in method update of dict object at 0x7fd34011f200> Application
splunk universal_forwarder 9.1.0 <built-in method update of dict object at 0x7fd2a28b32c0> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:haxx:libcurl:7.88.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:haxx:libcurl:7.88.1:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap:9.0:-:*:*:*:*:*:*
Yes cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

References