CVE-2016-8619: Use After Free
In curl's implementation of the Kerberos authentication mechanism, the function readdata() in security.c is used to fill the necessary krb5 structures. When reading one of the length fields from the socket, it fails to ensure that the length parameter passed to realloc() is not set to 0.
This would lead to realloc() getting called with a zero size and when doing so realloc() returns NULL and frees the memory - in contrary to normal realloc() fails where it only returns NULL - causing libcurl to free the memory again in the error path.
This flaw could be triggered by a malicious or just otherwise ill-behaving server.
External References:
https://curl.haxx.se/docs/adv20161102E.html
Other sources
The function readdata() in security.c in curl before version 7.51.0 is vulnerable to memory double free.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8619?
CVE-2016-8619 is classified as a medium severity vulnerability that can lead to a memory double free issue in curl.
How do I fix CVE-2016-8619?
To fix CVE-2016-8619, upgrade to curl version 7.51.0 or later.
What versions of curl are affected by CVE-2016-8619?
CVE-2016-8619 affects all versions of curl prior to 7.51.0.
What is the impact of CVE-2016-8619 on systems using curl?
The impact of CVE-2016-8619 may result in application crashes or undefined behavior due to memory management issues.
Is CVE-2016-8619 related to Kerberos authentication in curl?
Yes, CVE-2016-8619 specifically affects curl's implementation of the Kerberos authentication mechanism.