Use-After-Free Vulnerability in Crow HTTP Framework
CVE-2022-38667

9.8CRITICAL

Key Information:

Vendor

Crowcpp

Status
Crow
Vendor
CVE Published:
22 August 2022

What is CVE-2022-38667?

The Crow HTTP Framework, specifically versions up to and including 1.0+4, has a vulnerability that enables a use-after-free condition. This occurs during HTTP pipelining, where the framework's connection layer does not properly process ongoing requests. As a result, it can start processing a new request before completing the previous one, potentially allowing attackers to execute arbitrary code by exploiting this oversight. This vulnerability emphasizes the importance of proper request handling and synchronization in server applications.

References

https://cwe.mitre.org/data/definitions/372.html
x_refsource_MISC
https://github.com/CrowCpp/Crow/pull/524
x_refsource_MISC
https://github.com/0xhebi/CVEs/blob/main/Crow/CVE-2022-38...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.