CVE-2023-27537

What it actually does

Double-free or use-after-free in libcurl when HSTS data is shared across separate handles in multi-threaded contexts without synchronization primitives, leading to memory corruption and potential denial of service.

Why it matters to the business

Applications relying on affected libcurl versions in multi-threaded environments may experience crashes or instability; although the issue has been public for years with available exploits, low exploitation probability means limited immediate operational disruption but requires prioritized patching to avoid future availability issues.

How an attack unfolds

An attacker crafts conditions to trigger concurrent access to shared HSTS data structures in a multi-threaded application using vulnerable libcurl, causing the library to perform a double-free or use-after-free due to missing thread locks, resulting in memory corruption that can crash the process.

How to fix it

Upgrade libcurl to version 8.0.0 or later; for the affected drush (Bitnami) package, update to version 9.2.15 or newer. Disable HSTS sharing across threads if immediate upgrade is not feasible, and review multi-threaded curl usage patterns.

How to confirm the fix worked

Verify installed libcurl version is at least 8.0.0 and drush (Bitnami) is at least 9.2.15; test multi-threaded scenarios involving HSTS to confirm absence of crashes under concurrent access; review changelogs for mutex additions in HSTS handling.

Typical attack path

1. Identify target application using libcurl < 8.0.0 with HSTS sharing enabled across threads
2. Trigger or influence multi-threaded code paths that access shared HSTS cache
3. Cause concurrent operations leading to unsynchronized free operations on HSTS data
4. Exploit resulting memory state for denial of service via process crash

How to detect it

Review application logs for segmentation faults or memory errors during curl operations involving HSTS; search process dumps or crash reports for patterns related to HSTS data structures; monitor for unusual thread contention or repeated connection failures in multi-threaded services.

What your security team should do

• Immediately upgrade all instances of drush (Bitnami) to 9.2.15 and libcurl to 8.0.0+ given exploit availability despite low EPSS
• Audit applications for multi-threaded libcurl usage with shared handles and add thread synchronization if upgrades delayed
• Monitor for application crashes correlated with HSTS operations as a temporary detection measure
• Prioritize patching in environments with high thread concurrency even though KEV status is false