CVE-2023-28320: apple macos Uncontrolled Resource Consumption

Vulnerability summary

CVE-2023-28320 is a medium (CVSS 5.9) Uncontrolled Resource Consumption vulnerability in apple macos. EPSS estimates a 2.66% chance of exploitation in the next 30 days, higher than 85.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-05-2023
   PublishedVulnerability first disclosed.
2. 15-01-2025
   Last modifiedVulnerability information updated.

Description

A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.