CVE-2017-8818 log

Source
Severity High
Remote Yes
Type Arbitrary code execution
Description
An out-of-bounds flaw has been found in the SSL related code of libcurl >= 7.56.0 and < 7.57.0. When allocating memory for a connection (the internal struct called connectdata), a certain amount of memory is allocated at the end of the struct to be used for SSL related structs. Those structs are used by the particular SSL library libcurl is built to use. The application can also tell libcurl which specific SSL library to use if it was built to support more than one. The math used to calculate the extra memory amount necessary for the SSL library was wrong on 32 bit systems, which made the allocated memory too small by 4 bytes. The last struct member of the last object within the memory area could then be outside of what was allocated. Accessing that member could lead to a crash or other undefined behaviors depending on what memory that is present there and how the particular SSL library decides to act on that memory content.
Specifically the vulnerability is present if libcurl was built so that sizeof(long long *) < sizeof(long long) which as far as we are aware only happens in 32-bit builds.
Group Package Affected Fixed Severity Status Ticket
AVG-529 libcurl-gnutls 7.56.1-1 7.57.0-1 High Not affected
AVG-528 libcurl-compat 7.56.1-1 7.57.0-1 High Not affected
AVG-527 curl 7.56.1-1 7.57.0-1 High Not affected
AVG-523 lib32-libcurl-gnutls 7.56.1-1 7.57.0-1 High Fixed
AVG-522 lib32-libcurl-compat 7.56.1-1 7.57.0-1 High Fixed
AVG-521 lib32-curl 7.56.1-1 7.57.0-1 High Fixed
Date Advisory Group Package Severity Description
30 Nov 2017 ASA-201711-38 AVG-522 lib32-libcurl-compat High multiple issues
30 Nov 2017 ASA-201711-37 AVG-523 lib32-libcurl-gnutls High multiple issues
30 Nov 2017 ASA-201711-36 AVG-521 lib32-curl High multiple issues
References
https://curl.haxx.se/docs/adv_2017-af0a.html
https://curl.haxx.se/CVE-2017-8818.patch
https://github.com/curl/curl/commit/9b5e12a5491d2e6b68e0c88ca56f3a9ef9fba400
Notes
only affects 32-bit variants
Introduced by: https://github.com/curl/curl/commit/70f1db321a2b39c75f679b5b052aa1ac0636bd50