Log in Start free

Vulnerability · Published Sep 23, 2021 · Assigned by hackerone

CVE-2021-22945

Critical 9.1

In plain English

A critical-severity double free in https://github.com/curl/curl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.7% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)6.7%top 6.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20curl7.79.0-r0ALPINE-CVE-2021-22945
Alpine:v3.21curl7.79.0-r0ALPINE-CVE-2021-22945
Alpine:v3.22curl7.79.0-r0ALPINE-CVE-2021-22945
Alpine:v3.23curl7.79.0-r0ALPINE-CVE-2021-22945
Alpine:v3.24curl7.79.0-r0ALPINE-CVE-2021-22945
Debian:12curl7.79.1-1DEBIAN-CVE-2021-22945
Debian:13curl7.79.1-1DEBIAN-CVE-2021-22945
Debian:14curl7.79.1-1DEBIAN-CVE-2021-22945
Ubuntu:22.04:LTScurl7.74.0-1.3ubuntu2UBUNTU-CVE-2021-22945

Affected products (as reported)

VendorProductVersions
n/a https://github.com/curl/curl curl 7.73.0 to and including 7.78.0

Weakness: CWE-415 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References