CVE-2024-6197
Description
A vulnerability was found in cURL's utf8asn1str() function in the ASN1 parser, which causes a denial of service due to a memory allocation flaw. This flaw allows a remote attacker to use a specially crafted TLS certificate, causing the function to invoke free() on a 4-byte local stack buffer. While most modern malloc implementations detect and abort this error, some accept the pointer, leading to stack memory overwriting. This flaw likely results in a crash, though more serious consequences are possible in certain conditions.
Statement
This vulnerability in cURL's utf8asn1str() function is classified as a moderate severity issue rather than an important one due to its specific exploitability conditions and impact. While the flaw allows a remote attacker to induce a denial of service by triggering a memory allocation flaw, the outcome is generally a crash rather than more severe consequences. Modern memory management implementations typically detect and abort such improper free() operations, mitigating the risk of arbitrary code execution or extensive memory corruption. Additionally, the requirement of a specially crafted TLS certificate to exploit this vulnerability further limits its likelihood of widespread exploitation, thereby reducing the overall severity.
Exploitability requires:
A vulnerable libcurl (8.6.0–8.8.0) Built with non-OpenSSL TLS backend (e.g., GnuTLS, wolfSSL, etc.) The program must explicitly enable CURLOPT_CERTINFO An attacker must run a malicious TLS server with malformed certificates The ASN.1 parsing must hit an invalid UniversalString, and the memory allocator must not abort on free() of a stack pointer Considering it is a very narrow, environment-specific setup, AC:H would better reflect the realistic difficulty of exploiting this.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | 7.5 | 7.5 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | Low | Low |
| Privileges Required | None | None | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands; Modify Memory
There is the potential for arbitrary code execution with privileges of the vulnerable program via a "write, what where" primitive. If pointers to memory which hold user information are freed, a malicious user will be able to write 4 bytes anywhere in memory.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
