REDHAT-BUG-2448044: Use After Free
Use-After-Free vulnerability in the HTTP/2 server implementation of the libsoup HTTP library. The issue occurs in the onframerecvcallback() function when processing HTTP/2 frames. During header handling, the function increments an internal callback counter and emits signals such as soupservermessagegotheaders(). If a user-defined signal handler disconnects the client connection during this callback (for example due to authentication failure), the associated SoupServerMessageIOHTTP2 object may be destroyed and freed while still referenced by the callback. When execution returns to the callback, it continues to access the freed io object and attempts to update internal state, resulting in a heap use-after-free condition. An attacker can trigger this issue by sending HTTP/2 requests that cause authentication validation failures, potentially leading to application instability or crashes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2448044?
The severity of REDHAT-BUG-2448044 is classified as medium with a risk score of 4.
What type of vulnerability is identified in REDHAT-BUG-2448044?
REDHAT-BUG-2448044 describes a Use-After-Free vulnerability in the HTTP/2 server implementation of the libsoup HTTP library.
How do I fix REDHAT-BUG-2448044?
To fix REDHAT-BUG-2448044, update the libsoup package to the latest version that patches this vulnerability.
What software is affected by REDHAT-BUG-2448044?
The affected software for REDHAT-BUG-2448044 is the libsoup HTTP library.
What functions are involved in REDHAT-BUG-2448044?
The on_frame_recv_callback() function is involved in handling the vulnerability as it processes HTTP/2 frames.