CVE-2021-22901

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 11-06-2021 06:15

Last modified: - 13-05-2022 07:30

Total changes: - 12

Description

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

High

Attack complexity

Network

Attack vector

High

Availability

High

Confidentiality

High

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

8.1

Base score

2.2

5.9

Exploitability score

Impact score

Verification logic

vendor=haxx AND product=curl AND versionEndIncluding=7.76.1 AND versionStartIncluding=7.75.0

vendor=oracle AND product=mysql_server AND versionEndIncluding=8.0.25 AND versionStartIncluding=8.0.0

vendor=oracle AND product=essbase AND versionStartIncluding=21.0 AND versionEndExcluding=21.3

vendor=oracle AND product=essbase AND versionEndExcluding=11.1.2.4.047

vendor=oracle AND product=mysql_server AND versionEndIncluding=5.7.34

vendor=oracle AND product=communications_cloud_native_core_network_slice_selection_function AND version=1.8.0

vendor=oracle AND product=communications_cloud_native_core_network_repository_function AND version=1.15.0

vendor=oracle AND product=communications_cloud_native_core_network_function_cloud_native_environment AND version=1.10.0

vendor=oracle AND product=communications_cloud_native_core_service_communication_proxy AND version=1.15.0

vendor=oracle AND product=communications_cloud_native_core_network_repository_function AND version=1.15.1

vendor=oracle AND product=communications_cloud_native_core_binding_support_function AND version=1.11.0

vendor=netapp AND product=cloud_backup AND version=-

vendor=netapp AND product=snapcenter AND version=-

vendor=netapp AND product=oncommand_workflow_automation AND version=-

vendor=netapp AND product=oncommand_insight AND version=-

vendor=netapp AND product=solidfire_\&_hci_management_node AND version=-

vendor=netapp AND product=active_iq_unified_manager AND version=- AND target_software=windows

vendor=netapp AND product=solidfire_baseboard_management_controller_firmware AND version=-

vendor=netapp AND product=solidfire\,_enterprise_sds_\&_hci_storage_node AND version=-

vendor=netapp AND product=active_iq_unified_manager AND version=- AND target_software=vsphere

AND

vendor=netapp AND product=hci_compute_node_firmware AND version=-

vendor=netapp AND product=hci_compute_node AND version=-

AND

vendor=netapp AND product=h300e_firmware AND version=-

vendor=netapp AND product=h300e AND version=-

AND

vendor=netapp AND product=h300s_firmware AND version=-

vendor=netapp AND product=h300s AND version=-

AND

vendor=netapp AND product=h410s_firmware AND version=-

vendor=netapp AND product=h410s AND version=-

AND

vendor=netapp AND product=h500e_firmware AND version=-

vendor=netapp AND product=h500e AND version=-

AND

vendor=netapp AND product=h500s_firmware AND version=-

vendor=netapp AND product=h500s AND version=-

AND

vendor=netapp AND product=h700e_firmware AND version=-

vendor=netapp AND product=h700e AND version=-

AND

vendor=netapp AND product=h700s_firmware AND version=-

vendor=netapp AND product=h700s AND version=-

vendor=siemens AND product=sinec_infrastructure_network_services AND versionEndExcluding=1.0.1.1

Reference

Keywords

CVE-2021-22901

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2021-22901

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures