Junglewise Threat Intelligence

CVE-2023-38545: curl SOCKS5 heap buffer overflow during handshake

CVE-2023-38545 · Severity: critical · CVSS 9.8 · Published 2023-10-18

Technologies: Apple macOS Monterey, Curl Libcurl, Apple iPadOS, Curl. Vendors: Apple.

Executive brief

A vulnerability in the popular curl data transfer tool and library could allow an attacker to crash applications or potentially execute unauthorized code. The issue occurs when curl is configured to use a SOCKS5 proxy to connect to a website with an unusually long address. This could lead to system instability or data breaches if a user is redirected to a malicious web address.

Technical details

A heap-based buffer overflow exists in libcurl's SOCKS5 proxy handshake implementation. When curl is configured to let the SOCKS5 proxy resolve the hostname (SOCKS5_HOSTNAME), it normally limits hostnames to 255 bytes. However, due to a logic error in the non-blocking state machine, a 'slow' handshake can cause curl to incorrectly attempt to copy a hostname up to 65,535 bytes into a smaller heap-based download buffer (defaulting to 16kB). This occurs because a local variable tracking whether to resolve the name remotely is mismanaged during state transitions. An attacker can trigger this by providing a maliciously crafted URL or via a redirect. The vulnerability is patched in curl version 8.4.0.

Affected products

  • curl curl 7.69.0 to 8.3.0
  • curl libcurl 7.69.0 to 8.3.0
  • Apple iOS 16.7.5
  • Apple iPadOS 16.7.5
  • Apple macOS Monterey 12.7.3

Timeline

  • 2023-10-11: advisory: Original project advisory published
  • 2023-10-18: disclosed: NVD publication date
  • 2024-01-22: patched: Apple released updates for iOS and macOS addressing the issue

References

Related threats