CVE-2024-7264

Description

libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.

Gravité et risque d'exploitation

CVE-2024-7264 obtient un score CVSS de 6.3/10, soit une gravité moyenne. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 20.20 %, ce qui la place devant 97.4 % des CVE référencées.

Que faire ?

• Vérifiez si curl (versions <=7.37.1, 7.71.0, <=7.82.0, <=7.79.1, 7.38.0, 7.65.3, 7.45.0, 7.51.0, <=7.83.1, 7.84.0, <=7.61.0, <=7.62.0, <=8.5.0, 7.81.0, 7.37.0, <=7.45.0, 7.77.0, 7.65.2, 7.52.1, <=7.44.0, 8.1.0, <=7.58.0, <=7.55.1, <=7.56.1, <=7.50.1, <=7.54.1, 7.48.0, <=7.61.1, <=7.40.0, <=7.71.0, 7.82.0, 8.9.0, <=7.69.0, 7.64.1, <=7.47.1, <=7.64.0, <=8.1.2, 7.85.0, 7.56.0, <=7.53.0, 7.35.0, 8.6.0, 8.4.0, 7.50.2, <=7.49.1, 7.78.0, 7.54.0, 7.79.1, <=7.50.2, <=7.50.3, <=7.34.0, <=7.36.0, <=7.64.1, <=7.70.0, <=7.52.0, 7.55.1, <=7.65.2, <=8.6.0, <=7.41.0, 7.83.0, 7.62.0, 8.1.2, <=7.69.1, <=8.1.0, <=7.74.0, 7.56.1, 7.42.0, 7.83.1, 7.65.0, <=7.57.0, 7.49.1, 7.42.1, <=7.39.0, 7.69.0, 7.68.0, <=7.50.0, <=7.59.0, 7.46.0, 7.53.0, 8.2.1, <=7.79.0, <=7.71.1, <=7.67.0, 7.71.1, 7.54.1, <=7.48.0, <=7.32.0, 8.3.0, 8.2.0, 7.57.0, 7.63.0, <=7.85.0, <=7.43.0, <=7.47.0, <=7.60.0, 7.47.0, <=7.35.0, 7.70.0, <=7.76.0, 8.1.1, 7.76.1, <=7.55.0, <=7.73.0, 7.50.0, <=7.76.1, <=7.77.0, <=7.42.0, <=7.88.0, <=7.65.3, <=8.0.0, <=7.81.0, 7.80.0, 7.76.0, 7.60.0, <=8.9.0, 7.49.0, 7.61.0, <=7.68.0, <=7.65.1, 7.37.1, 7.88.1, 7.32.0, 7.34.0, 7.33.0, 7.61.1, 7.88.0, <=7.65.0, <=7.37.0, <=8.8.0, 7.43.0, <=7.49.0, 7.86.0, <=7.66.0, <=7.86.0, <=7.88.1, <=7.72.0, 7.53.1, 8.8.0, 7.59.0, 7.66.0, 7.52.0, <=7.38.0, 7.65.1, 8.7.1, 7.67.0, <=7.78.0, <=8.2.1, 7.69.1, <=7.56.0, <=7.51.0, <=7.54.0, <=7.33.0, <=8.0.1, 7.55.0, 7.79.0, 8.5.0, 7.64.0, 7.75.0, 7.73.0, <=8.7.0, 7.72.0, <=7.75.0, 7.39.0, 8.7.0, <=7.80.0, <=7.83.0, 7.47.1, 8.0.0, 7.87.0, 7.50.3, 7.44.0, <=8.3.0, <=7.53.1, <=7.52.1, 7.41.0, <=8.7.1, <=7.46.0, <=8.4.0, 7.50.1, <=7.87.0, 8.0.1, <=8.1.1, <=8.2.0, 7.40.0, <=7.42.1, 7.74.0, 7.36.0, <=7.63.0, <=7.84.0, 7.58.0) est présent sur votre parc.
• Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
• À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
• Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

• https://curl.se/docs/CVE-2024-7264.json
• https://curl.se/docs/CVE-2024-7264.html
• https://hackerone.com/reports/2629968
• http://www.openwall.com/lists/oss-security/2024/07/31/1