Use-after-free in cURL - CVE-2022-43552

Vulnerability identifier: #VU70456

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-43552

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
cURL
IBM Qradar SIEM
Gentoo Linux
Debian Linux
PowerSC
Amazon Linux AMI
Oracle Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Anolis OS
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
CentOS
Red Hat Enterprise Linux Desktop
IBM AIX
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Oracle Solaris
SUSE Linux Enterprise Server 12 SP4 LTSS
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
macOS
Ubuntu
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
openSUSE Leap
openEuler
Fedora
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
cflinuxfs3
Telemetry Dashboard
Liquidware
IBM Engineering Requirements Management DOORS Next
Citrix Workspace App
Webex App VDI
ObjectScale
Storage Defender – Data Protect
IBM Cloud Pak for Watson AIOps
Platform Automation Toolkit
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Watson Studio on Cloud Pak for Data
Storage Ceph
IBM supplied MQ Advanced container images
EMC Cloud Tiering Appliance
Dell PowerProtect Cyber Recovery
VMware Tanzu Application Service for VMs
Isolation Segment
VMware Tanzu RabbitMQ for VMs
Data Lakehouse
Service Telemetry Framework
Migration Toolkit for Virtualization
IBM MQ Operator
IBM Spectrum Copy Data Management
IBM Cloud Transformation Advisor
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Dell Secure Connect Gateway
Session Smart Router
IBM Safer Payments
IBM Security Verify Governance
IBM QRadar WinCollect Agent
IBM Spectrum Protect Plus
IBM Robotic Process Automation
Self Node Remediation Operator
VMware Tanzu Operations Manager
JBoss Core Services
LANTIME Operating System Firmware (LTOS)
Juniper Secure Analytics (JSA)
Splunk Enterprise
Splunk Universal Forwarder
Cisco Jabber
Cisco Webex Meetings
VMware Horizon Client
Dell EMC Container Storage Modules
libcurl3-gnutls (Ubuntu package)
curl (Ubuntu package)
libcurl3-nss (Ubuntu package)
libcurl3 (Ubuntu package)
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
jbcs-httpd24-openssl-chil (Red Hat package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
libcurl-devel
curl
libcurl
curl (Red Hat package)
libcurl4 (Ubuntu package)
curl-debuginfo
libcurl4
libcurl4-debuginfo-32bit
libcurl4-32bit
libcurl4-debuginfo
curl-debugsource
libcurl4-32bit-debuginfo
libcurl-devel-32bit
curl-help
curl (Debian package)
jbcs-httpd24-curl (Red Hat package)
net-misc/curl
SINEC NMS
Red Hat OpenShift GitOps
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
RecoverPoint for VMs
RSA Authentication Manager

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error while processing denied requests from HTTP proxies when using SMB or TELNET protocols. A remote attacker can trigger a use-after-free error and crash the application.

Install updates from vendor's website.

• https://curl.haxx.se/docs/CVE-2022-43552.html