CVE-2022-35260

Vulnerability

Curl's .netrc file parser contains a stack-based buffer overread and off-by-one write vulnerability. When a .netrc file ends with a line containing exactly 4095 consecutive non-whitespace characters and no trailing newline, the parser reads past the end of the allocated stack buffer and, if the read succeeds, writes a zero byte beyond the buffer boundary. This affects curl versions prior to 7.86.0 [3].

Exploitation

An attacker must be able to supply a crafted .netrc file to an application that uses curl with netrc parsing enabled. The attacker creates a file whose last line consists of 4095 non-whitespace characters (e.g., letters) without a terminating newline. When curl processes this file, the flawed parsing logic triggers the buffer overread and off-by-one write, typically resulting in a segmentation fault.

Impact

Successful exploitation causes a denial of service (crash) in the curl process. The description notes that in most cases a segfault occurs, but under specific circumstances other outcomes may be possible. The Gentoo advisory lists this among multiple curl vulnerabilities, but the primary impact described for this CVE is denial of service.

Mitigation

The vulnerability is fixed in curl version 7.86.0 [3]. Users should upgrade to this version or later. No workaround is known at this time [3].