CVE-2025-0665 Overview
CVE-2025-0665 is a double-free style file descriptor vulnerability in libcurl. The library wrongly closes the same eventfd file descriptor twice when tearing down a connection channel after completing a threaded name resolve. This defect affects curl 8.11.1 and is also tracked downstream by NetApp across multiple HCI and H-series storage firmware components. The flaw stems from incorrect resource management in the asynchronous DNS resolver path that uses eventfd for inter-thread signaling.
Critical Impact
A double-close of an eventfd descriptor can corrupt the file descriptor table of long-running processes, causing unintended file or socket operations on unrelated descriptors and potential availability impact in services linking libcurl.
Affected Products
- Haxx curl 8.11.1
- NetApp HCI Compute Node and Bootstrap OS
- NetApp H300S, H410C, H410S, H500S, H700S storage systems and firmware
Discovery Timeline
- 2025-02-05 - CVE-2025-0665 published to NVD with curl project advisory
- 2025-03-06 - NetApp publishes advisory NTAP-20250306-0007
- 2026-03-17 - Last updated in NVD database
Technical Details for CVE-2025-0665
Vulnerability Analysis
The vulnerability resides in the threaded name resolver subsystem of libcurl. When libcurl is built with threaded DNS resolution, it uses an eventfd file descriptor to signal completion between the resolver thread and the main transfer loop. During connection teardown after the resolve completes, the cleanup path closes this eventfd descriptor more than once.
Double-closing a file descriptor is dangerous in multi-threaded programs. After the first close(), the kernel may reassign the same descriptor number to a new socket, file, or pipe opened by another thread. The second close() then terminates that unrelated descriptor, breaking I/O for completely different operations within the same process.
This class of bug falls under improper resource shutdown and release. While the curl project rates the security impact as low, integrators running long-lived services that link libcurl can experience unpredictable failures, leaked sessions, or cross-channel data interactions.
Root Cause
The cleanup logic for the asynchronous resolver channel does not correctly track ownership of the eventfd descriptor. The teardown routine invokes close() on the descriptor in two separate code paths without resetting the stored value to -1 after the first release.
Attack Vector
Exploitation requires a network-reachable attack scenario with high complexity. An attacker must influence DNS resolution timing or trigger specific connection teardown conditions in an application using libcurl with threaded resolves enabled. Successful triggering can cause denial of service or, in race-prone conditions, descriptor confusion within the host process.
No public proof-of-concept exploit code is available for CVE-2025-0665. Refer to the curl CVE-2025-0665 advisory and the HackerOne Report #2954286 for the upstream technical analysis.
Detection Methods for CVE-2025-0665
Indicators of Compromise
- Application crashes or assertion failures in processes linking libcurl 8.11.1 during or after DNS resolution
- Unexpected EBADF errors logged by services performing concurrent network I/O
- Closed sockets or files in long-running daemons that previously held valid descriptors
Detection Strategies
- Inventory installed libcurl versions across endpoints and servers, flagging instances at version 8.11.1
- Audit NetApp HCI and H-series firmware against advisory NTAP-20250306-0007 for affected releases
- Inspect application logs for repeated close() syscalls on the same descriptor using strace or eBPF tracing
Monitoring Recommendations
- Track outbound DNS resolution latency and connection teardown errors in applications using libcurl
- Alert on abnormal process restarts for services that depend on threaded curl resolves, such as automation agents and backup tools
- Subscribe to curl security advisories and NetApp product security notifications for downstream patch availability
How to Mitigate CVE-2025-0665
Immediate Actions Required
- Upgrade libcurl to version 8.12.0 or later where the double-close defect is fixed
- Apply NetApp firmware updates referenced in advisory NTAP-20250306-0007 for HCI Compute Nodes and H-series systems
- Rebuild and redeploy statically linked applications that bundle the vulnerable libcurl 8.11.1
Patch Information
The curl project published the official fix and full technical write-up in the curl CVE-2025-0665 documentation. NetApp tracks downstream remediation in the NetApp Advisory NTAP-20250306-0007. Distribution maintainers have backported the fix; consult your operating system vendor for the appropriate package update.
Workarounds
- Build libcurl without threaded resolver support by configuring with --disable-threaded-resolver until patching is feasible
- Use the c-ares asynchronous resolver as an alternative DNS backend, which does not rely on the affected eventfd cleanup path
- Restrict use of vulnerable curl-based tooling in long-running, multi-threaded services where descriptor confusion would have the highest impact
# Verify installed libcurl version and rebuild option
curl --version
# Example: configure libcurl without the threaded resolver as a workaround
./configure --disable-threaded-resolver --enable-ares
make && sudo make install
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
