Loading vulnerability…
Invalid Free of Stack Memory in libcurl ASN.1 Parser
CVE-2024-6197 is an invalid-memory-free vulnerability in libcurl's ASN.1 parser. When utf8asn1str() encounters an invalid field while parsing an ASN.1 UTF-8 string, its error-handling path calls free() on a four-byte local stack buffer. Most modern allocators detect the invalid pointer and terminate the process. Other allocators may accept the pointer and overwrite nearby stack memory with allocator metadata. A malicious server can trigger the vulnerable path by presenting a specially crafted TLS certificate. Process termination is the most likely result; more serious consequences, including possible code execution, depend on allocator behavior and execution conditions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker controlling a server contacted by an affected client can cause the application using libcurl to crash, resulting in denial of service. Allocators that accept the stack pointer may corrupt adjacent stack memory with pointers and flags determined by the allocator, rather than directly chosen by the attacker. Code execution is a potential outcome under special circumstances, not an established consequence on all affected systems.
If you can’t patch tonight, do this now.
As an interim exposure-reduction measure, restrict affected clients' connections to trusted servers and apply appropriate network access controls. This does not correct the invalid free. No specific parser-level workaround is established.
Patch, then assume compromise.
Install vendor updates that address CVE-2024-6197 in curl/libcurl and applications that bundle the library. Specified fixed package versions include Echo curl 8.8.0+e1 or later and Google COS net-misc/curl 17800.309.7 or later; these are vendor-specific version identifiers. For Windows-bundled curl, apply the applicable October 2024 security updates or superseding updates. Affected Siemens devices running SINEC OS before V3.3 should be upgraded to V3.3 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.