Resolves: CVE-2018-16840 - fix use-after-free in handle close

This commit is contained in:
Kamil Dudka 2018-11-01 09:59:22 +01:00
parent 7576775e08
commit 2bcb05aea4
2 changed files with 44 additions and 0 deletions

View File

@ -0,0 +1,39 @@
From 235f209a0e62edee654be441a50bb0c154edeaa5 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Thu, 18 Oct 2018 15:07:15 +0200
Subject: [PATCH] Curl_close: clear data->multi_easy on free to avoid
use-after-free
Regression from b46cfbc068 (7.59.0)
CVE-2018-16840
Reported-by: Brian Carpenter (Geeknik Labs)
Bug: https://curl.haxx.se/docs/CVE-2018-16840.html
Upstream-commit: 81d135d67155c5295b1033679c606165d4e28f3f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
---
lib/url.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/url.c b/lib/url.c
index f159008..dcc1ecc 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -319,10 +319,12 @@ CURLcode Curl_close(struct Curl_easy *data)
and detach this handle from there. */
curl_multi_remove_handle(data->multi, data);
- if(data->multi_easy)
+ if(data->multi_easy) {
/* when curl_easy_perform() is used, it creates its own multi handle to
use and this is the one */
curl_multi_cleanup(data->multi_easy);
+ data->multi_easy = NULL;
+ }
/* Destroy the timeout list that is held in the easy handle. It is
/normally/ done by curl_multi_remove_handle() but this is "just in
--
2.17.2

View File

@ -19,6 +19,9 @@ Patch4: 0004-curl-7.61.1-CVE-2018-16842.patch
# we need `git apply` to apply this patch # we need `git apply` to apply this patch
BuildRequires: git BuildRequires: git
# fix use-after-free in handle close (CVE-2018-16840)
Patch5: 0005-curl-7.61.1-CVE-2018-16840.patch
# patch making libcurl multilib ready # patch making libcurl multilib ready
Patch101: 0101-curl-7.32.0-multilib.patch Patch101: 0101-curl-7.32.0-multilib.patch
@ -181,6 +184,7 @@ be installed.
%patch2 -p1 %patch2 -p1
%patch3 -p1 %patch3 -p1
git apply %{PATCH4} git apply %{PATCH4}
%patch5 -p1
# Fedora patches # Fedora patches
%patch101 -p1 %patch101 -p1
@ -348,6 +352,7 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
%changelog %changelog
* Thu Nov 01 2018 Kamil Dudka <kdudka@redhat.com> - 7.61.1-4 * Thu Nov 01 2018 Kamil Dudka <kdudka@redhat.com> - 7.61.1-4
- fix use-after-free in handle close (CVE-2018-16840)
- fix bad arethmetic when outputting warnings to stderr (CVE-2018-16842) - fix bad arethmetic when outputting warnings to stderr (CVE-2018-16842)
* Thu Oct 11 2018 Kamil Dudka <kdudka@redhat.com> - 7.61.1-3 * Thu Oct 11 2018 Kamil Dudka <kdudka@redhat.com> - 7.61.1-3