CVE-2022-32221
📋 TL;DR
This vulnerability in libcurl allows an attacker to cause memory corruption or data leakage when reusing a handle from a PUT to a POST request. Applications using libcurl for HTTP(S) transfers with reused handles are affected. The flaw can lead to use-after-free or incorrect data transmission.
💻 Affected Systems
- libcurl
- curl command-line tool
- Applications using libcurl library
📦 What is this software?
Curl by Haxx
curl is a command-line tool and library for transferring data with URLs. It supports numerous protocols including HTTP, HTTPS, FTP, and more, making it essential for API testing, web scraping, and automated data transfers.
Learn more about Curl →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
Remote code execution or sensitive data exposure through memory corruption in applications using vulnerable libcurl versions.
Likely Case
Application crashes, data corruption, or unintended data transmission in HTTP(S) client operations.
If Mitigated
Limited impact with proper input validation and handle management, but still potential for denial of service.
🎯 Exploit Status
Exploitation requires specific conditions of handle reuse between PUT and POST requests, but public proof-of-concept exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libcurl 7.87.0 and later
Vendor Advisory: https://curl.se/docs/CVE-2022-32221.html
Restart Required: Yes
Instructions:
1. Update libcurl to version 7.87.0 or later. 2. For curl command-line tool, update to version 7.87.0+. 3. Restart applications using libcurl. 4. Recompile applications if statically linked.
🔧 Temporary Workarounds
Avoid handle reuse between PUT and POST
allCreate separate curl handles for PUT and POST operations instead of reusing the same handle.
Disable CURLOPT_READFUNCTION for POST
allEnsure CURLOPT_READFUNCTION is not set when using CURLOPT_POSTFIELDS for POST requests.
🧯 If You Can't Patch
- Implement strict handle lifecycle management - create new handles for each request type
- Add input validation and bounds checking in callback functions to prevent memory corruption
🔍 How to Verify
Check if Vulnerable:
Check libcurl version with 'curl --version' or 'ldconfig -p | grep libcurl'. If version is between 7.16.0 and 7.86.0, system is vulnerable.Check Version:
curl --version | head -1Verify Fix Applied:
Verify libcurl version is 7.87.0 or later. Test application with PUT-POST handle reuse scenarios.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access errors
- Unexpected data in HTTP POST requests
- Segmentation faults in curl-related processes
Network Indicators:
- POST requests containing data from previous PUT operations
- Malformed HTTP requests from applications using libcurl
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "use-after-free" OR "memory corruption") AND process="*curl*"🔗 References
- http://seclists.org/fulldisclosure/2023/Jan/19
- http://seclists.org/fulldisclosure/2023/Jan/20
- http://www.openwall.com/lists/oss-security/2023/05/17/4
- https://hackerone.com/reports/1704017
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20230110-0006/
- https://security.netapp.com/advisory/ntap-20230208-0002/
- https://support.apple.com/kb/HT213604
- https://support.apple.com/kb/HT213605
- https://www.debian.org/security/2023/dsa-5330
- http://seclists.org/fulldisclosure/2023/Jan/19
- http://seclists.org/fulldisclosure/2023/Jan/20
- http://www.openwall.com/lists/oss-security/2023/05/17/4
- https://hackerone.com/reports/1704017
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html
- https://security.gentoo.org/glsa/202212-01
- https://security.netapp.com/advisory/ntap-20230110-0006/
- https://security.netapp.com/advisory/ntap-20230208-0002/
- https://support.apple.com/kb/HT213604
- https://support.apple.com/kb/HT213605
- https://www.debian.org/security/2023/dsa-5330
