CVE-2024-7264: Haxx Libcurl ASN.1 Parser DOS Vulnerability

CVE-2024-7264 Overview

libcurl's ASN1 parser code has the GTime2str() function, used for parsing an ASN.1 Generalized Time field. If given a syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a strlen() getting performed on a pointer to a heap buffer area that is not purposely null terminated.

This flaw most likely leads to a crash but can also lead to heap contents getting returned to the application when CURLINFO_CERTINFO is used.

Critical Impact
Potential heap content leakage and application crash.

Affected Products

haxx libcurl

Discovery Timeline

2024-07-31 - CVE CVE-2024-7264 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-7264

Vulnerability Analysis

The key issue arises from the incorrect length parameter, which when negative, leads to unintended heap reads. The potential for data leakage or application crash escalates the vulnerability severity.

Root Cause

Improper handling of the ASN.1 Generalized Time field can lead to a negative length calculation.

Attack Vector

Exploitation is possible over the network by sending malformed ASN.1 sequences.

// Example exploitation code (sanitized)
#include <string.h>

char *malformed_input = "ASN1_TIME_WITH_ERROR";
int length = -1; // Intended calculation error
strlen(malformed_input + length);

Detection Methods for CVE-2024-7264

Indicators of Compromise

Unexpected heap reads
Application crashes when handling certificates
Heap dump contents in logs

Detection Strategies

Monitoring for abnormal heap usage and crashes in applications using libcurl. Utilize SentinelOne’s behavioral AI to alert on suspicious activities such as unexpected memory access patterns.

Monitoring Recommendations

Implement continuous monitoring using SentinelOne’s endpoint protection to detect anomalies in application behavior when handling ASN.1 data.

How to Mitigate CVE-2024-7264

Immediate Actions Required

Upgrade to the latest version of libcurl
Enable advanced endpoint protection
Monitor network traffic for malformed ASN.1 sequences

Patch Information

Review and apply patches provided by Haxx Advisory.

Workarounds

If patching is not immediately possible, restrict applications from processing untrusted ASN.1 fields.

bash

# Configuration example
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" \
   source address="malicious_ip" drop'
firewall-cmd --reload