Double free in cURL - CVE-2024-6197

Vulnerability identifier: #VU94715

CSH Severity: Medium

CVSS v4 BT: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-6197

CWE-ID: CWE-415

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in ASN1 parser within the utf8asn1str() function. A remote attacker can pass specially crafted TLS certificate to the application, trigger double free error and execute arbitrary code on the target system.

The vulnerable code can only be reached when curl is built to use GnuTLS, wolfSSL, Schannel or Secure Transport.

cURL
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
PowerSC
Basesystem Module
openSUSE Leap
Fedora
DataStage on Cloud Pak for Data
webMethods Managed File Transfer
Storage Protect Backup-Archive Client
Nessus Network Monitor
SecurityCenter
LANTIME Operating System Firmware (LTOS)
Data Lakehouse
IBM QRadar WinCollect Agent
Autodesk Infraworks
curl
libcurl4-32bit
curl-debugsource
libcurl-devel-64bit
libcurl4-64bit
libcurl4
libcurl4-64bit-debuginfo
curl-debuginfo
libcurl4-debuginfo
libcurl4-32bit-debuginfo
libcurl-devel-32bit
libcurl-devel

Install updates from vendor's website.

cURL - update to 8.9.0
PowerSC - update to 2.2.0.3
DataStage on Cloud Pak for Data - update to 5.2.1
Nessus Network Monitor - update to 6.5.0
SecurityCenter - addressed in versions SC-202408.1, SC-202504.2
LANTIME Operating System Firmware (LTOS) - update to 7.08.015
Data Lakehouse - update to 1.3.0.0
Storage Protect Backup-Archive Client - update to 8.1.24
curl - update to 8.6.0-9.fc40
libcurl4-32bit - update to 8.6.0-150600.4.3.1
curl-debugsource - update to 8.6.0-150600.4.3.1
curl - update to 8.6.0-150600.4.3.1
libcurl-devel-64bit - update to 8.6.0-150600.4.3.1
libcurl4-64bit - update to 8.6.0-150600.4.3.1
libcurl4 - update to 8.6.0-150600.4.3.1
libcurl4-64bit-debuginfo - update to 8.6.0-150600.4.3.1
curl-debuginfo - update to 8.6.0-150600.4.3.1
libcurl4-debuginfo - update to 8.6.0-150600.4.3.1
libcurl4-32bit-debuginfo - update to 8.6.0-150600.4.3.1
libcurl-devel-32bit - update to 8.6.0-150600.4.3.1
libcurl-devel - update to 8.6.0-150600.4.3.1
IBM QRadar WinCollect Agent - update to 10.1.12
Autodesk Infraworks - addressed in versions 2022.1.10.363, 2023.1.5.251, 2024.1.4.152, 2025.02.86

• https://curl.se/docs/CVE-2024-6197.json
• https://curl.se/docs/CVE-2024-6197.html
• https://hackerone.com/reports/2559516
• http://www.openwall.com/lists/oss-security/2024/07/24/1

• Multiple vulnerabilities in cURL
• Fedora 40 update for curl
• SUSE update for curl
• Multiple vulnerabilities in Tenable Security Center
• Multiple vulnerabilities in IBM QRadar WinCollect Agent
• Multiple vulnerabilities in Nessus Network Monitor
• Autodesk InfraWorks update for third-party components
• Multiple vulnerabilities in IBM PowerSC
• Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client
• Dell Data Lakehouse System software update for third-party components
• Tenable Security Center update for third-party components
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• Meinberg LANTIME firmware update for curl
• IBM DataStage on Cloud Pak for Data update for libcurl