CVE-2023-28320
siglongjmp race condition
Project curl Security Advisory, May 17th 2023 - Permalink
VULNERABILITY
libcurl provides several different backends for resolving hostnames,
selected at build time. If it is built to use the synchronous resolver,
it allows name resolves to time-out slow operations using
alarm() and siglongjmp().
When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
INFO
Most platforms and systems build libcurl to use the threaded resolver
or with c-ares, neither of those suffer from this flaw. Most platforms
that build with the synchronous resolver do not feature
alarm() and siglongjmp() and therefore are not
vulnerable either.
Since alarm() uses signals, it is not advisable to use
in a multi-threaded environment (signals and threads rarely mix very
well) which reduces the risk that this flaw hurts many users.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2023-28320 to this issue.
CWE-662: Improper Synchronization
Severity: Low
AFFECTED VERSIONS
- Affected versions: curl 7.9.8 to and including 8.0.1
- Not affected versions: curl < 7.9.8 and curl >= 8.1.0
- Introduced-in: https://github.com/curl/curl/commit/3c49b405de4fbf1f
libcurl is used by many applications, but not always advertised as such!
SOLUTION
The fix is to only support this timeout ability if curl has and can properly mutex protect the buffer.
RECOMMENDATIONS
A - Upgrade curl to version 8.1.0
B - Apply the patch to your local version
C - Do not use the synchronous name resolver option
TIMELINE
This issue was reported to the curl project on April 2 2023. We contacted distros@openwall on May 9, 2023.
curl 8.1.0 was released on May 17 2023, coordinated with the publication of this advisory.
CREDITS
- Reported-by: Harry Sintonen
- Patched-by: Harry Sintonen, Daniel Stenberg
Thanks a lot!