Memory leak in Curl_auth_create_ntlm_type3_message

How it was found

Summary:

When handling NTLMv2, if the decoded type-2 “TargetInfo” is large enough that ntresplen+header_size exceeds NTLM_BUFSIZE (1024), the code returns early without freeing ntlmv2resp, causing a memory leak.

https://github.com/curl/curl/blob/7d5d0645e5562f65005488fbc7fd270a71239a5f/lib/vauth/ntlm.c#L789

Security Impact: Low A malicious peer can set TargetInfo to be above the threshold and cause the client to leak memory. With repeated connections, this can gradually exhaust the resources of the client.

This vulnerability was found using Theori's Xint Code (an AI-powered tool), but validated and confirmed by our human researchers.

Affected version

Affects the latest version, 8.16.0

Steps To Reproduce:

We'll use the curl fuzzers as a way to PoC the issue, but in the wild the issue could be triggered by a malicious HTTP server.

1. Build the fuzzers for curl: 1a. git clone https://github.com/curl/curl-fuzzers.git 1b. cd curl-fuzzers && ./mainline.sh
2. Generate the PoC input by running the attached script 2a. python poc.py # outputs ./input.bin
3. Run the fuzzer on the generated input: 3.a ./build/curl_fuzzer_http input.bin

 ./build/curl_fuzzer_http input.bin 
[input.bin] Opened.. Read 1408 bytes, fuzzing.. complete !!

=================================================================
==2757954==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 964 byte(s) in 1 object(s) allocated from:
    #0 0x563de804999d in calloc (/home/user/tjbecker/curl-fuzzer/build/curl_fuzzer_http+0x6be99d) (BuildId: c1a573bc4310acd581ec5b1466ea99bb00d3c79f)
    #1 0x563de80e4a90 in curl_dbg_calloc (/home/user/tjbecker/curl-fuzzer/build/curl_fuzzer_http+0x759a90) (BuildId: c1a573bc4310acd581ec5b1466ea99bb00d3c79f)
    #2 0x563de84520ca in Curl_ntlm_core_mk_ntlmv2_resp (/home/user/tjbecker/curl-fuzzer/build/curl_fuzzer_http+0xac70ca) (BuildId: c1a573bc4310acd581ec5b1466ea99bb00d3c79f)
    #3 0x563de83e6420 in Curl_auth_create_ntlm_type3_message (/home/user/tjbecker/curl-fuzzer/build/curl_fuzzer_http+0xa5b420) (BuildId: c1a573bc4310acd581ec5b1466ea99bb00d3c79f)
    #4 0x563de8357698 in Curl_output_ntlm (/home/user/tjbecker/curl-fuzzer/build/curl_fuzzer_http+0x9cc698) (BuildId: c1a573bc4310acd581ec5b1466ea99bb00d3c79f)
    #5 0x563de82ed9f2 in output_auth_headers http.c
    #6 0x563de82ed30f in Curl_http_output_auth (/home/user/tjbecker/curl-fuzzer/build/curl_fuzzer_http+0x96230f) (BuildId: c1a573bc4310acd581ec5b1466ea99bb00d3c79f)
    #7 0x563de82e3afd in Curl_http (/home/user/tjbecker/curl-fuzzer/build/curl_fuzzer_http+0x958afd) (BuildId: c1a573bc4310acd581ec5b1466ea99bb00d3c79f)
    #8 0x563de812b460 in multi_do multi.c
    #9 0x563de81288a9 in state_do multi.c
    #10 0x563de8116b00 in multi_runsingle multi.c
    #11 0x563de8114894 in curl_multi_perform (/home/user/tjbecker/curl-fuzzer/build/curl_fuzzer_http+0x789894) (BuildId: c1a573bc4310acd581ec5b1466ea99bb00d3c79f)
    #12 0x563de808c3f7 in fuzz_handle_transfer(fuzz_data*) /home/user/tjbecker/curl-fuzzer/curl_fuzzer.cc:341:3
    #13 0x563de808a70d in LLVMFuzzerTestOneInput /home/user/tjbecker/curl-fuzzer/curl_fuzzer.cc:97:3
    #14 0x563de9487ff9 in main (/home/user/tjbecker/curl-fuzzer/build/curl_fuzzer_http+0x1afcff9) (BuildId: c1a573bc4310acd581ec5b1466ea99bb00d3c79f)
    #15 0x7f5e7782a1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #16 0x7f5e7782a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #17 0x563de7fae964 in _start (/home/user/tjbecker/curl-fuzzer/build/curl_fuzzer_http+0x623964) (BuildId: c1a573bc4310acd581ec5b1466ea99bb00d3c79f)

SUMMARY: AddressSanitizer: 964 byte(s) leaked in 1 allocation(s).

Supporting Material/References:

https://github.com/curl/curl/blob/7d5d0645e5562f65005488fbc7fd270a71239a5f/lib/vauth/ntlm.c#L789

Impact

Summary:

Security Impact: Low A malicious peer can set TargetInfo to be above the threshold and cause the client to leak memory. With repeated connections, this can gradually exhaust the resources of the client.