5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-28320

CVE-2023-28320: A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several...

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using alarm() and siglongjmp(). When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-28320

CVE-2023-28320:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2023-28320) is a race condition caused by the unsynchronized use of a global buffer (curl_jmpenv) for sigsetjmp/siglongjmp operations during synchronous name resolution timeouts.

The introducing commit 3c49b405de4fbf1f added this timeout mechanism using sigsetjmp (in Curl_resolv) and siglongjmp (in alarmfunc) with a global curl_jmpenv buffer without mutex protection.

The fixing commit 13718030ad4b3209a7583b addresses this by adding a mutex (curl_jmpenv_lock) around the critical section in Curl_resolv_timeout where sigsetjmp is called and the alarm is configured.

Curl_resolv_timeout (in lib/hostip.c) is identified as vulnerable because it sets the sigjmp_buf curl_jmpenv via sigsetjmp without proper locking in the vulnerable versions. This allows multiple threads to overwrite this global buffer, leading to a race condition.
alarmfunc (in lib/hostip.c) is identified as part of the vulnerable mechanism because it executes siglongjmp using the potentially corrupted curl_jmpenv. If curl_jmpenv points to an invalid state due to the race condition, alarmfunc's execution will lead to a crash or misbehavior.

Both functions are critical to the vulnerability: Curl_resolv_timeout creates the race condition by improperly managing the shared resource, and alarmfunc triggers the fault by using this compromised resource.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.