Docs Overview
Project
Bug Bounty Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Logo TODO website Info
Protocols
CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket
Releases
Changelog curl CVEs Release Table Version Numbering Vulnerabilities
Tool
Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added
Who and Why
Companies Copyright Sponsors Thanks The name
curl / Docs / curl CVEs / ASN.1 date parser overread
Related:
Audits
Bug Bounty
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table
Awarded 540 USD

CVE-2024-7264

ASN.1 date parser overread

Project curl Security Advisory, July 31st 2024 - Permalink

VULNERABILITY

libcurl's ASN1 parser code has the GTime2str() function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a strlen() getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.

This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when CURLINFO_CERTINFO is used.

INFO

The ASN.1 parsing is done after a successful TLS handshake, which then also means that the used TLS library has parsed the certificate. If the TLS library rejects the bad date string, then it cannot reach and trigger libcurl's bug. We can however not be sure that there are not circumstances in which the bad data still gets parsed by libcurl.

This bug is considered a C mistake (likely to have been avoided had we not been using C).

This flaw also affects the curl command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2024-7264 to this issue.

CWE-125: Out-of-bounds Read

Severity: Low

AFFECTED VERSIONS

The vulnerable code can only be reached when curl is built to use GnuTLS, Schannel, Secure Transport or mbedTLS. Builds using other TLS backends are not vulnerable.

libcurl is used by many applications, but not always advertised as such!

This parser bug was actually introduced in curl 7.32.0 but was then used only by the GSKit TLS backend which is no longer supported. The functionality was later brought to other TLS backends in different versions, so this bug affects curl built with different backends starting in different versions:

SOLUTION

Note that this fixing commit was a follow-up to this previous incomplete fix: https://github.com/curl/curl/commit/3c914bc680155b321

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl and libcurl to version 8.9.1

B - Apply the patch to your version and rebuild

C - Build your libcurl with an unaffected TLS backend

TIMELINE

This issue was reported to the curl project on July 30, 2024. We contacted distros@openwall on July 30, 2024.

curl 8.9.1 was released on July 31 2024 around 06:00 UTC, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!