CVE-2016-8623

Vulnerability

A use-after-free flaw exists in the cookie handling of cURL before version 7.51.0 [4]. The vulnerability occurs when multiple threads access shared cookies concurrently, leading to a race condition that can cause a use-after-free condition. This affects all cURL versions prior to 7.51.0 [1][2].

Exploitation

To exploit this vulnerability, an attacker must be able to trigger a race condition in a multi-threaded application using cURL's shared cookie functionality. The attacker does not need authentication but must have the ability to control one of the threads accessing the shared cookie data [3]. The race window is exploited by carefully timing operations to free a cookie while another thread still holds a reference to it.

Impact

Successful exploitation results in a use-after-free, which can lead to information disclosure [4]. An attacker may be able to read sensitive data from memory, such as other cookies or potentially other application data, depending on the memory layout [3]. The confidentiality of the system is compromised, but integrity and availability are not directly affected.

Mitigation

Upgrade cURL to version 7.51.0 or later [1][2]. Red Hat has provided updated packages for httpd24-curl (7.61.1) and JBoss Core Services Apache HTTP Server 2.4.29 [1][2]. Tenable has fixed this in LCE 4.8.2 [3]. No workarounds are known; updating is the only mitigation.