Bug 2270498 (CVE-2024-2398) - CVE-2024-2398 curl: HTTP/2 push headers memory-leak
Summary: CVE-2024-2398 curl: HTTP/2 push headers memory-leak
Keywords:
Status: NEW
Alias: CVE-2024-2398
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2271825 2270503 2271824
Blocks: 2270489
TreeView+ depends on / blocked
 
Reported: 2024-03-20 15:35 UTC by Patrick Del Bello
Modified: 2024-10-07 13:01 UTC (History)
47 users (show)

Fixed In Version: curl 8.7.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in curl. When an application configures libcurl to use HTTP/2 server push and the amount of received headers for the push surpasses the maximum allowed limit, libcurl aborts the server push. When aborting, libcurl does not free all the previously allocated headers, resulting in a memory leak.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:5553 0 None None None 2024-08-19 07:54:36 UTC
Red Hat Product Errata RHBA-2024:5557 0 None None None 2024-08-19 08:19:00 UTC
Red Hat Product Errata RHBA-2024:5564 0 None None None 2024-08-19 09:19:00 UTC
Red Hat Product Errata RHBA-2024:5597 0 None None None 2024-08-20 09:31:32 UTC
Red Hat Product Errata RHBA-2024:5604 0 None None None 2024-08-20 10:07:36 UTC
Red Hat Product Errata RHBA-2024:5674 0 None None None 2024-08-21 01:05:38 UTC
Red Hat Product Errata RHBA-2024:5675 0 None None None 2024-08-21 01:12:51 UTC
Red Hat Product Errata RHBA-2024:5676 0 None None None 2024-08-21 02:26:19 UTC
Red Hat Product Errata RHBA-2024:5677 0 None None None 2024-08-21 03:27:30 UTC
Red Hat Product Errata RHBA-2024:5685 0 None None None 2024-08-21 11:05:09 UTC
Red Hat Product Errata RHBA-2024:5706 0 None None None 2024-08-21 13:17:39 UTC
Red Hat Product Errata RHBA-2024:5707 0 None None None 2024-08-21 13:20:45 UTC
Red Hat Product Errata RHBA-2024:5761 0 None None None 2024-08-22 08:44:21 UTC
Red Hat Product Errata RHBA-2024:5805 0 None None None 2024-08-26 01:40:10 UTC
Red Hat Product Errata RHBA-2024:5822 0 None None None 2024-08-26 07:54:43 UTC
Red Hat Product Errata RHBA-2024:5823 0 None None None 2024-08-26 08:03:26 UTC
Red Hat Product Errata RHBA-2024:5835 0 None None None 2024-08-26 08:01:04 UTC
Red Hat Product Errata RHBA-2024:5843 0 None None None 2024-08-26 09:25:06 UTC
Red Hat Product Errata RHBA-2024:5869 0 None None None 2024-08-26 17:53:17 UTC
Red Hat Product Errata RHBA-2024:5870 0 None None None 2024-08-26 17:53:42 UTC
Red Hat Product Errata RHBA-2024:5881 0 None None None 2024-08-27 07:43:21 UTC
Red Hat Product Errata RHBA-2024:5896 0 None None None 2024-08-27 12:21:50 UTC
Red Hat Product Errata RHBA-2024:5897 0 None None None 2024-08-27 12:24:46 UTC
Red Hat Product Errata RHBA-2024:5904 0 None None None 2024-08-27 14:15:55 UTC
Red Hat Product Errata RHBA-2024:5914 0 None None None 2024-08-27 23:19:38 UTC
Red Hat Product Errata RHBA-2024:5917 0 None None None 2024-08-28 01:23:17 UTC
Red Hat Product Errata RHBA-2024:5920 0 None None None 2024-08-28 06:52:19 UTC
Red Hat Product Errata RHBA-2024:5922 0 None None None 2024-08-28 08:35:51 UTC
Red Hat Product Errata RHBA-2024:5926 0 None None None 2024-08-28 10:12:46 UTC
Red Hat Product Errata RHBA-2024:5932 0 None None None 2024-08-28 12:18:23 UTC
Red Hat Product Errata RHBA-2024:5933 0 None None None 2024-08-28 12:18:43 UTC
Red Hat Product Errata RHBA-2024:5936 0 None None None 2024-08-28 14:29:54 UTC
Red Hat Product Errata RHBA-2024:5945 0 None None None 2024-08-28 15:51:06 UTC
Red Hat Product Errata RHBA-2024:5949 0 None None None 2024-08-28 16:26:05 UTC
Red Hat Product Errata RHBA-2024:5987 0 None None None 2024-08-29 06:50:23 UTC
Red Hat Product Errata RHBA-2024:5988 0 None None None 2024-08-29 06:56:16 UTC
Red Hat Product Errata RHBA-2024:5989 0 None None None 2024-08-29 06:51:03 UTC
Red Hat Product Errata RHBA-2024:5990 0 None None None 2024-08-29 06:34:24 UTC
Red Hat Product Errata RHBA-2024:5991 0 None None None 2024-08-29 07:43:24 UTC
Red Hat Product Errata RHBA-2024:5992 0 None None None 2024-08-29 07:38:14 UTC
Red Hat Product Errata RHBA-2024:5993 0 None None None 2024-08-29 07:31:21 UTC
Red Hat Product Errata RHBA-2024:5994 0 None None None 2024-08-29 07:34:43 UTC
Red Hat Product Errata RHBA-2024:5995 0 None None None 2024-08-29 07:01:20 UTC
Red Hat Product Errata RHBA-2024:5996 0 None None None 2024-08-29 07:02:35 UTC
Red Hat Product Errata RHBA-2024:5997 0 None None None 2024-08-29 07:05:35 UTC
Red Hat Product Errata RHBA-2024:6019 0 None None None 2024-08-29 10:33:02 UTC
Red Hat Product Errata RHBA-2024:6032 0 None None None 2024-08-29 11:57:34 UTC
Red Hat Product Errata RHBA-2024:6039 0 None None None 2024-08-29 12:54:08 UTC
Red Hat Product Errata RHBA-2024:6120 0 None None None 2024-09-02 08:07:52 UTC
Red Hat Product Errata RHBA-2024:6128 0 None None None 2024-09-02 13:40:24 UTC
Red Hat Product Errata RHBA-2024:6150 0 None None None 2024-09-03 02:14:43 UTC
Red Hat Product Errata RHBA-2024:6151 0 None None None 2024-09-03 01:57:38 UTC
Red Hat Product Errata RHBA-2024:6200 0 None None None 2024-09-03 07:22:58 UTC
Red Hat Product Errata RHBA-2024:6213 0 None None None 2024-09-03 11:31:35 UTC
Red Hat Product Errata RHBA-2024:6214 0 None None None 2024-09-03 11:51:16 UTC
Red Hat Product Errata RHBA-2024:6215 0 None None None 2024-09-03 11:34:43 UTC
Red Hat Product Errata RHBA-2024:6216 0 None None None 2024-09-03 12:18:14 UTC
Red Hat Product Errata RHBA-2024:6218 0 None None None 2024-09-03 11:47:39 UTC
Red Hat Product Errata RHBA-2024:6233 0 None None None 2024-09-03 14:17:38 UTC
Red Hat Product Errata RHBA-2024:6234 0 None None None 2024-09-03 14:17:18 UTC
Red Hat Product Errata RHBA-2024:6260 0 None None None 2024-09-03 22:10:45 UTC
Red Hat Product Errata RHBA-2024:6476 0 None None None 2024-09-09 08:07:01 UTC
Red Hat Product Errata RHBA-2024:6477 0 None None None 2024-09-09 08:15:41 UTC
Red Hat Product Errata RHBA-2024:6512 0 None None None 2024-09-09 19:11:03 UTC
Red Hat Product Errata RHBA-2024:6578 0 None None None 2024-09-11 10:32:36 UTC
Red Hat Product Errata RHBA-2024:6579 0 None None None 2024-09-11 10:33:24 UTC
Red Hat Product Errata RHBA-2024:6580 0 None None None 2024-09-11 10:38:28 UTC
Red Hat Product Errata RHBA-2024:6716 0 None None None 2024-09-17 11:12:13 UTC
Red Hat Product Errata RHBA-2024:6717 0 None None None 2024-09-17 11:57:08 UTC
Red Hat Product Errata RHBA-2024:6770 0 None None None 2024-09-18 17:50:09 UTC
Red Hat Product Errata RHBA-2024:7258 0 None None None 2024-09-26 17:24:52 UTC
Red Hat Product Errata RHBA-2024:7378 0 None None None 2024-09-30 11:58:35 UTC
Red Hat Product Errata RHBA-2024:7451 0 None None None 2024-10-01 14:32:19 UTC
Red Hat Product Errata RHBA-2024:7749 0 None None None 2024-10-07 13:01:46 UTC
Red Hat Product Errata RHSA-2024:2693 0 None None None 2024-05-07 15:47:44 UTC
Red Hat Product Errata RHSA-2024:2694 0 None None None 2024-05-07 15:44:52 UTC
Red Hat Product Errata RHSA-2024:3998 0 None None None 2024-06-20 05:49:53 UTC
Red Hat Product Errata RHSA-2024:5529 0 None None None 2024-08-19 07:00:03 UTC
Red Hat Product Errata RHSA-2024:5654 0 None None None 2024-08-20 18:15:13 UTC
Red Hat Product Errata RHSA-2024:7213 0 None None None 2024-09-26 13:28:49 UTC
Red Hat Product Errata RHSA-2024:7374 0 None None None 2024-09-30 10:26:14 UTC

Description Patrick Del Bello 2024-03-20 15:35:48 UTC 
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.

Further, this error condition fails silently and is therefore not easily detected by an application.

If a server sends many `PUSH_PROMISE` frames with an excessive amount of headers, this can lead to multiple megabytes of memory leaked *per response*.

HTTP/2 server push is a relatively rarely used feature.

Reference:
https://curl.se/docs/CVE-2024-2398.html

Upstream patch:
https://github.com/curl/curl/commit/deca8039991886a559b67bcd6
Comment 3 Guilherme de Almeida Suckevicz 2024-03-27 13:17:20 UTC 
Created curl tracking bugs for this issue:

Affects: fedora-all [bug 2271824]


Created mingw-curl tracking bugs for this issue:

Affects: fedora-all [bug 2271825]
Comment 6 errata-xmlrpc 2024-05-07 15:44:47 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2024:2694 https://access.redhat.com/errata/RHSA-2024:2694
Comment 7 errata-xmlrpc 2024-05-07 15:47:40 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2024:2693 https://access.redhat.com/errata/RHSA-2024:2693
Comment 9 errata-xmlrpc 2024-06-20 05:49:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:3998 https://access.redhat.com/errata/RHSA-2024:3998
Comment 10 errata-xmlrpc 2024-08-19 07:00:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:5529 https://access.redhat.com/errata/RHSA-2024:5529
Comment 11 errata-xmlrpc 2024-08-20 18:15:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:5654 https://access.redhat.com/errata/RHSA-2024:5654
Comment 12 errata-xmlrpc 2024-09-26 13:28:45 UTC 
This issue has been addressed in the following products:

  Service Interconnect 1.4 for RHEL 9

Via RHSA-2024:7213 https://access.redhat.com/errata/RHSA-2024:7213
Comment 13 errata-xmlrpc 2024-09-30 10:26:10 UTC 
This issue has been addressed in the following products:

  Service Interconnect 1 for RHEL 9

Via RHSA-2024:7374 https://access.redhat.com/errata/RHSA-2024:7374
Note You need to log in before you can comment on or make changes to this bug.