Use after free in hyperfifo example
None
Vulnerability Details
## Summary:
THIS ONLY IS AN ISSUE IN EXAMPLE CODE, NOT CURL ITSELF!
In the hyperfifo example the event base is freed before the curl_multi_cleanup is called. This leads to a use after free in the addsocket callback, when libevent tries to lock a mutex in the base event during the curl shutdown.
Link to the problematic code: https://github.com/curl/curl/blob/d6807890696019308bc885871575f3c2dac875d4/docs/examples/hiperfifo.c#L453
## Affected version
8.18.0, but the bug has been there for a while, likely since the beginning of that example. Interestingly the multi-event example seems to not be affected.
## Steps To Reproduce:
Running the example under ASAN should be sufficient. I have however not verified that, however the same code did cause crashes in my project: https://nheko.im/nheko-reborn/coeurl/-/commit/7e0afef3e774497efa29bf581630747cddd95e55 https://github.com/Nheko-Reborn/nheko/issues/1941
## Impact
## Summary:
ONLY AFFECTS AN EXAMPLE! NOT A BUG IN CURL!
The impact should basically be none, I am only submitting this here, because I haven't found documentation on how issues in examples should be submitted and other projects might have copied the example as a base (like I did), which can lead to crashes in some circumstances. As such I am just being overly careful in reporting this, please close this as invalid or whatever, if you think that is the best approach. I just wanted to let you judge the impact of this instead of me just reporting something possibly sensitive on the bug tracker.
I don't think an attacker could achieve much more that a crash in projects, that copied the example code.
For example we were affected by this, but haven't filed any security issue about it either: https://github.com/Nheko-Reborn/nheko/issues/1941
Actions
View on HackerOneReport Stats
- Report ID: 3580247
- State: Closed
- Substate: informative