Bug 2299654 (CVE-2024-6874)

Summary: CVE-2024-6874 curl: macidn punycode buffer overread
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: adudiak, bdettelb, csutherl, dfreiber, drow, jburrell, jclere, jmitchel, jtanner, kshier, omaciel, pjindal, plodge, stcannon, szappis, vkumar, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A buffer overread vulnerability was found in Curl's URL API function curl_url_get(). This issue allows a remote attacker to obtain sensitive information due to a punycode buffer overread flaw. By sending a specially crafted request, an attacker can gain sensitive information and potentially launch further attacks against the affected system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2024-07-24 08:21:32 UTC 
libcurl's URL API function
[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode
conversions, to and from IDN. Asking to convert a name that is exactly 256
bytes, libcurl ends up reading outside of a stack based buffer when built to
use the *macidn* IDN backend. The conversion function then fills up the
provided buffer exactly - but does not null terminate the string.

This flaw can lead to stack contents accidently getting returned as part of
the converted string.
Comment 1 TEJ RATHI 2024-07-25 06:26:54 UTC 
From Advisory:

AFFECTED VERSIONS

The vulnerable code can only be reached when curl is built to use macidn, the native IDN conversion library bundled with Apple's operating systems: macOS, iOS, ipadOS etc. Builds using other IDN backends are not vulnerable.

    Affected version: curl 8.8.0
    Not affected versions: curl < 8.8.0 and >= 8.9.0
    Introduced-in: https://github.com/curl/curl/commit/add22feeef07858307be57