Use-after-free in libevent - #VU136951

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in evws_new_session when handling error paths after evhttp_start_ws_ frees the request object. A remote attacker can trigger a subsequent call that uses the freed request object to cause a denial of service.

The advisory states that this condition was not found to be reachable because the null pointer dereference is hit first.

Affected software

Remediation

External References

• https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34
• https://github.com/libevent/libevent/blob/a994a52d5373d6284b27576efa617aff2baa7bd3/ws.c#L374

Related Security Bulletins

• Multiple vulnerabilities in libevent