CVE-2025-0665

What it actually does

Double close of the same eventfd file descriptor during connection teardown after threaded name resolution leads to use-after-free in libcurl.

Why it matters to the business

Applications using affected packages may crash or exhibit memory corruption during network operations, causing service outages and requiring emergency patching across Ubuntu-based systems.

How an attack unfolds

An attacker triggers a libcurl connection with threaded DNS resolution enabled; after name resolution completes and the channel is torn down, the double eventfd close creates a use-after-free that may be leveraged for memory corruption or denial of service.

How to fix it

Upgrade linux-aws-5.15 (Ubuntu 20.04 LTS) to version 5.15.0-1056.61~20.04.1 or later.

How to confirm the fix worked

Confirm installed package version is at or above the fixed release and exercise name-resolution code paths under load to verify stability.

Typical attack path

1. Initiate network request via libcurl with threaded resolver active
2. Allow threaded name resolution to complete
3. Trigger connection channel teardown
4. Trigger use-after-free via the double-closed eventfd

How to detect it

Monitor process logs and core dumps for segmentation faults or double-free errors in libcurl-related code paths during connection teardown.

What your security team should do

• Apply the listed kernel package update without delay
• Restart affected services after patching
• Audit custom applications for direct libcurl usage and schedule upgrades