Docs Overview
Project
Bug Bounty Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Logo TODO website Info
Protocols
CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket
Releases
Changelog curl CVEs Release Table Version Numbering Vulnerabilities
Tool
Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added
Who and Why
Companies Copyright Sponsors Thanks The name
curl / Docs / curl CVEs / SSL out of buffer access
Related:
Audits
Bug Bounty
Changelog
curl CVEs
JSON metadata
Vulnerability Disclosure
Vulnerabilities Table

CVE-2017-8818

SSL out of buffer access

Project curl Security Advisory, November 29th 2017 - Permalink

VULNERABILITY

libcurl contains an out boundary access flaw in SSL related code.

When allocating memory for a connection (the internal struct called connectdata), a certain amount of memory is allocated at the end of the struct to be used for SSL related structs. Those structs are used by the particular SSL library libcurl is built to use. The application can also tell libcurl which specific SSL library to use if it was built to support more than one.

The math used to calculate the extra memory amount necessary for the SSL library was wrong on 32 bit systems, which made the allocated memory too small by 4 bytes. The last struct member of the last object within the memory area could then be outside of what was allocated. Accessing that member could lead to a crash or other undefined behaviors depending on what memory that is present there and how the particular SSL library decides to act on that memory content.

Specifically the vulnerability is present if libcurl was built so that sizeof(long long *) < sizeof(long long) which as far as we are aware only happens in 32-bit builds.

INFO

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2017-8818 to this issue.

CWE-125: Out-of-bounds Read

Severity: High

AFFECTED VERSIONS

This is only an issue on systems with 32 bit pointers. (Technically, on systems where sizeof(long long *) < sizeof(long long).)

curl is used by many applications, but not always advertised as such.

SOLUTION

In libcurl version 7.57.0, the allocation size is corrected.

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl to version 7.57.0

B - Apply the patch to your version and rebuild

TIMELINE

It was reported to the curl project on November 18, 2017. We contacted distros@openwall on November 24.

curl 7.57.0 was released on November 29 2017, coordinated with the publication of this advisory.

(The original report was made in public)

CREDITS

Thanks a lot!