CVE-2022-42915

Vulnerability

Double free vulnerability in curl versions 7.77.0 through 7.85.0. When curl is configured to use an HTTP proxy and the URL uses a non-HTTP(S) scheme (dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, telnet), it issues a CONNECT request. If the proxy returns a non-200 response, the error handling cleanup can double free a heap allocation [3].

Exploitation

An attacker controlling an HTTP proxy (or a man-in-the-middle) can trigger the double free by returning a non-200 status to a CONNECT request for one of the affected schemes. No user interaction beyond using curl with an HTTP proxy is required. The attacker needs network position to intercept or control the proxy response [3].

Impact

A double free can lead to program crash or potential arbitrary code execution. Given the complexity of heap state, reliable exploitation may be difficult, but the vulnerability is considered medium severity (CVSS score not specified in advisory, but severity medium) [3].

Mitigation

Upgrade to curl 7.86.0 or later, released on October 26, 2022. Alternatively, apply the provided patch or avoid using an HTTP proxy with affected URL schemes. The vulnerability was introduced in 7.77.0 and fixed in 7.86.0 [3].