Bug 1642203 (CVE-2018-16840)

Summary: CVE-2018-16840 curl: Use-after-free when closing "easy" handle in Curl_close()
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: abhgupta, bodavis, csutherl, dbaker, dbhole, erik-fedora, gzaronik, hhorak, jclere, john.j5live, jokerman, jorton, kanderso, kdudka, lgao, luhliari, mbabacek, mike, mturk, myarboro, omajid, paul, rwagner, security-response-team, sthangav, trankin, tsorense, twalsh, weli, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: curl 7.62.0 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-25 09:51:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1644555, 1644556, 1644557, 1652660    
Bug Blocks: 1642204    

Description Sam Fowler 2018-10-24 01:51:43 UTC 
Curl versions 7.59.0 to 7.61.1 are vulnerable to heap use-after-free flaw in code related to closing an easy handle.

When closing and cleaning up an "easy" handle in the `Curl_close()` function,
the library code first frees a struct (without nulling the pointer) and might
then subsequently erroneously write to a struct field within that already
freed struct.
Comment 1 Sam Fowler 2018-10-24 01:52:01 UTC 
Acknowledgments:

Name: the Curl project
Upstream: Brian Carpenter (Geeknik Labs)
Comment 2 Sam Fowler 2018-10-31 07:02:05 UTC 
External Reference:

https://curl.haxx.se/docs/CVE-2018-16840.html


Upstream Patch:

https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f
Comment 3 Sam Fowler 2018-10-31 07:02:42 UTC 
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 1644555]


Created mingw-curl tracking bugs for this issue:

Affects: epel-7 [bug 1644556]