CVE-2021-22945

Vulnerability

The vulnerability occurs in libcurl's MQTT protocol handling when sending data to an MQTT server. Affected versions are libcurl <= 7.73.0 and also 7.78.0. Under certain conditions, libcurl erroneously keeps a pointer to a memory area that has already been freed, then uses that pointer in a subsequent send call and frees the same memory again, resulting in a double-free and use-after-free condition.

Exploitation

An attacker controlling an MQTT server that receives data from a vulnerable libcurl client could potentially trigger the vulnerability. The attacker needs to be able to influence the timing or content of MQTT messages to cause the erroneous pointer behavior. No authentication is required from the client side; the attacker merely needs to send responses that lead to the double-free.

Impact

Successful exploitation could lead to arbitrary code execution in the context of the application using libcurl, or cause a denial of service due to memory corruption. The impact depends on the attacker's ability to control the freed/reused memory.

Mitigation

The vulnerability is fixed in libcurl versions 7.74.0 through 7.77.2 and 7.78.1 and later. Users should upgrade to a fixed version. Gentoo provides a GLSA [4] recommending upgrade to curl-7.86.0. No workaround is known.