REDHAT-BUG-2528425: Use After Free
A heap use-after-free vulnerability exists in libsoup's HTTP/2 client implementation. When a GNOME application sends an HTTP/2 POST request with a file body (using a non-pollable GInputStream such as GFileInputStream), the body data is read asynchronously via ginputstreamreadasync(). If the remote HTTP/2 server sends a GOAWAY frame while this async read is pending, the SoupHTTP2MessageDatastructure is freed through the shutdown path, but the async read callback ondataread() still fires afterward, accessing the freed heap memory.
This is a remotely-triggerable heap use-after-free — a malicious HTTP/2 server (or MITM attacker) can deterministically trigger it when any GNOME application uploads a file over HTTPS with HTTP/2. Affected applications include GNOME Web (Epiphany), GNOME Software, Flatpak, and any GLib-based application using SoupSession for HTTP/2 file uploads.
Impact type: Heap use-after-free (CWE-416) — the freed 168-byte SoupHTTP2MessageData struct is read after free, and the freed datasourcebuffer may also be written to by the still-pending async I/O operation. This constitutes memory corruption with potential for information disclosure or code execution.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control or intercept to trigger the flaw?
The attacker must operate a malicious HTTP/2 server or act as a man-in-the-middle, and send an HTTP/2 GOAWAY frame while the client has a file-body POST read pending.
Which application activity creates the vulnerable condition?
A GLib-based application using SoupSession must upload a file over HTTPS using HTTP/2, with the file body supplied through a non-pollable GInputStream such as GFileInputStream.
Which applications are specifically identified as potentially exposed?
GNOME Web (Epiphany), GNOME Software, and Flatpak are identified, along with any GLib-based application using SoupSession for HTTP/2 file uploads.