CVE-2024-6197: 
vulnerability analysis and mitigation

CVE-2024-6197 affects libcurl's ASN1 parser in versions 8.6.0 to 8.8.0, specifically in the utf8asn1str() function used for parsing ASN.1 UTF-8 strings. The vulnerability was discovered on June 19, 2024, and publicly disclosed on July 24, 2024. The issue affects curl and libcurl when built with GnuTLS, wolfSSL, Schannel, Secure Transport, or mbedTLS as the TLS backend (Curl Advisory).

The vulnerability occurs when the utf8asn1str() function detects an invalid field and attempts to free() a 4-byte local stack buffer. While most modern malloc implementations detect this error and abort immediately, some implementations accept the input pointer and add that memory to their list of available chunks, leading to the overwriting of nearby stack memory. The vulnerability is classified as CWE-590: Free of Memory not on the Heap, with a CVSS v3.1 base score of 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (NVD, Curl Advisory).

The primary impact of this vulnerability is a potential Denial of Service (DoS). While the most likely outcome is a program crash, more serious consequences cannot be ruled out under special circumstances. Research by JFrog Security indicates that achieving remote code execution through this vulnerability is almost impossible in real-world setups (JFrog Blog).

The vulnerability can be triggered by a malicious server offering a specially crafted TLS certificate. The exploit requires the CURLINFO_CERTINFO flag to be set, which enables libcurl to gather detailed information about the SSL certificate chain. For the curl CLI tool, this can be triggered using specific CLI flags such as --write-out '%certs' (Curl Advisory, JFrog Blog).

Three mitigation options are recommended: 1) Upgrade curl and libcurl to version 8.9.0 or later, 2) Apply the patch to the existing version and rebuild, or 3) Build libcurl with an unaffected TLS backend. The vulnerability was fixed in commit 3a537a4db9e65e545 (Curl Advisory).