CVE-2023-28319

Vulnerability

A use-after-free vulnerability exists in libcurl before version 8.1.0 in the SSH public key verification feature using a SHA256 hash. When the fingerprint check fails, libcurl frees the memory for the fingerprint before constructing an error message that includes the (now freed) hash [4]. This can lead to heap data being leaked in the error output.

Exploitation

An attacker can trigger this vulnerability by causing a failed SSH public key verification, for example by providing an incorrect host key fingerprint. The attacker does not need prior authentication; exploitation can occur remotely if curl connects to a malicious SSH server that presents a mismatched key. The race window is not required, as the use-after-free occurs immediately upon verification failure.

Impact

On successful exploitation, sensitive heap data (the freed fingerprint memory) may be included in the error message returned to the user or logged, potentially disclosing heap contents. This could lead to information disclosure of other data residing on the heap, depending on the context.

Mitigation

The vulnerability is fixed in curl version 8.1.0 and later. Gentoo Linux recommends upgrading to >=net-misc/curl-8.3.0-r2 [4]. No workaround is currently available.