{"id":19480,"date":"2022-12-21T22:57:56","date_gmt":"2022-12-21T21:57:56","guid":{"rendered":"https:\/\/daniel.haxx.se\/blog\/?p=19480"},"modified":"2022-12-22T22:59:49","modified_gmt":"2022-12-22T21:59:49","slug":"the-2022-curl-security-audit","status":"publish","type":"post","link":"https:\/\/daniel.haxx.se\/blog\/2022\/12\/21\/the-2022-curl-security-audit\/","title":{"rendered":"The 2022 curl security audit"},"content":{"rendered":"\n

tldr: several hundred hours of dedicated scrutinizing of curl by a team of security experts resulted in two CVEs and a set of less serious remarks.<\/em> The link to the reports is at the bottom of this article.<\/p>\n\n\n\n

Thanks to an OpenSSF<\/a> grant, OSTIF<\/a> helped us set up a curl security audit, which the excellent Trail of Bits<\/a> was selected to perform in September 2022. We are most grateful to OpenSSF for doing this for us, and I hope all users who use and rely on curl recognize this extraordinary gift. OSTIF <\/a>and Trail of Bits<\/a> both posted articles about this audit separately.<\/p>\n\n\n\n

We previously had an audit performed on curl back in 2016<\/a> by Cure53<\/a> (sponsored by Mozilla) but I like to think that we (curl) have traveled quite far and matured a lot since those days. The fixes from the discoveries reported in that old previous audit were all merged and shipped in the 7.51.0 release, in November 2016. Now over six years ago.<\/p>\n\n\n\n

Changes since previous audit<\/h2>\n\n\n\n

We have done a lot in the project that have improved our general security situation over the last six years. I believe we are in a much<\/em> better place than the last time around. But we have also grown and developed a lot more features since then.<\/p>\n\n\n\n

curl is now at150,000<\/strong> lines of C code. This count is for “product code” only and excludes blank lines but includes 19%<\/strong> comments.<\/p>\n\n\n\n

71<\/strong> additional vulnerabilities have been reported and fixed since then. (42<\/strong> of those even existed in the version that was audited in 2016 but were obviously not detected)<\/p>\n\n\n\n

We have 30,000<\/strong> additional lines of code today (+27%), and we have done over 8,000<\/strong> commits since.<\/p>\n\n\n\n

We have 50%<\/strong> more test cases (now 1550).<\/p>\n\n\n\n

We have done 47<\/strong> releases featuring more than 4,200<\/strong> documented bugfixes and 150 changes\/new features.<\/p>\n\n\n\n

We have 25<\/strong> times the number of CI jobs: up from 5 in 2016 to 127<\/strong> today.<\/p>\n\n\n\n

The OSS-Fuzz project started fuzzing curl in 2017, and it has been fuzzing curl non-stop since.<\/p>\n\n\n\n

We introduced our “dynbuf” system<\/a> internally in 2020 for managing growing buffers to maybe avoid common C mistakes around those.<\/p>\n\n\n\n

Audit<\/h2>\n\n\n\n

The Trail of Bits team was assigned this as a three-part project:<\/p>\n\n\n\n

    \n
  1. Create a Threat Model document<\/li>\n\n\n\n
  2. Testing Analysis and Improvements<\/li>\n\n\n\n
  3. Secure code Review<\/li>\n<\/ol>\n\n\n\n

    The project was setup to use a total of 380 man hours and most of the time two Trail of Bits engineers worked in parallel on the different tasks. The Trail of Bits team themselves eventually also voluntarily extended the program with about a week. They had no problems finding people who wanted to join in and look into curl. We can safely say that they spent a significant amount of time and effort scrutinizing curl.<\/p>\n\n\n\n

    The curl security team members had frequent status meetings and assisted with details and could help answer questions. We would also get updates and reports on how they progressed.<\/p>\n\n\n\n

    Two security vulnerabilities were confirmed<\/h2>\n\n\n\n

    The first vulnerability they found ended up known as the CVE-2022-42915: HTTP proxy double-free<\/a> issue.<\/p>\n\n\n\n

    The second vulnerability was found after Trail of Bits had actually ended their work and their report, while they were still running a fuzzer that triggered a separate flaw. This second vulnerability is not covered in the report but was disclosed earlier today in sync with the curl 7.87.0 release announcement: CVE-2022-43552: HTTP Proxy deny use-after-free<\/a>.<\/p>\n\n\n\n

    Minor frictions detected<\/h2>\n\n\n\n

    Discoveries and remarks highlighted through their work that were not consider security sensitive we could handle on the fly. Some examples include:<\/p>\n\n\n\n