[<prev] [next>] [day] [month] [year] [list]
Message-ID: <rs5rs36-4q5q-299q-pr2n-5896n1196054@unkk.fr>
Date: Wed, 17 May 2023 08:40:59 +0200 (CEST)
From: Daniel Stenberg <daniel@...x.se>
To: curl security announcements -- curl users <curl-users@...ts.haxx.se>,
curl-announce@...ts.haxx.se, libcurl hacking <curl-library@...ts.haxx.se>,
oss-security@...ts.openwall.com
Subject: curl: CVE-2023-28319: UAF in SSH sha256 fingerprint check
UAF in SSH sha256 fingerprint check
====================================
Project curl Security Advisory, May 17th 2023 -
[Permalink](https://curl.se/docs/CVE-2023-28319.html)
VULNERABILITY
-------------
libcurl offers a feature to verify an SSH server's public key using a SHA 256
hash. When this check fails, libcurl would free the memory for the fingerprint
before it returns an error message containing the (now freed) hash.
This flaw risks inserting sensitive heap-based data into the error message
that might be shown to users or otherwise get leaked and revealed.
INFO
----
This only applies to users of the `CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256` option,
which is **only supported for libcurl built with libssh2** (curl optionally
supports other SSH backends). Either of the options `CURLOPT_VERBOSE` or
`CURLOPT_ERRORBUFFER` also need to be set to trigger the problem.
The damage is somewhat limited by the extremely short time window between the
free and the use of the freed memory.
The largest possible info leak that can happen due to this flaw per trigger
occasion, is limited to `CURL_ERROR_SIZE` - the error message prefix length
(69) = 186 bytes. It will also stop at the first null byte within those 186
bytes.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2023-28319 to this issue.
CWE-416: Use After Free
Severity: Medium
AFFECTED VERSIONS
-----------------
- Affected versions: curl 7.81.0 to and including 8.0.1
- Not affected versions: curl < 7.81.0 and curl >= 8.1.0
- Introduced-in: https://github.com/curl/curl/commit/3467e89bb97e6c87c7
libcurl is used by many applications, but not always advertised as such!
SOLUTION
------------
- Fixed-in: https://github.com/curl/curl/commit/8e21b1a05f3c0ee098dbcb6c
RECOMMENDATIONS
--------------
A - Upgrade curl to version 8.1.0
B - Apply the patch to your local version
C - Do not use `CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256`
TIMELINE
--------
This issue was reported to the curl project on March 21 2023. We contacted
distros@...nwall on May 9, 2023.
curl 8.1.0 was released on May 17 2023, coordinated with the publication of
this advisory.
CREDITS
-------
- Reported-by: Wei Chong Tan
- Patched-by: Daniel Stenberg
Thanks a lot!
--
/ daniel.haxx.se
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
