CVE-2021-22901 curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session t
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2021-22901?
CVE-2021-22901 is a high-severity vulnerability in Haxx Curl, published on 11 Jun 2021.
Official description
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.
Weakness: CWE-416
Which versions are affected by CVE-2021-22901?
It affects 26 products.
Products include Haxx Curl, Netapp Active Iq Unified Manager, Netapp Cloud Backup, Netapp H300e Firmware, Netapp H300s Firmware, Netapp H410s Firmware and 20 more.
How do I fix CVE-2021-22901?
Upgrade to a fixed version.
Is CVE-2021-22901 being exploited?
There is no known exploitation of CVE-2021-22901 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2021-22901, AZL-6360, CLEANSTART-2026-HL90171, CURL-CVE-2021-22901, GHSA-vjwf-ghhc-2p8q.