CVE-2022-43552: HTTP Proxy deny use-after-free
What the report claims
libcurl performs use-after-free on heap memory during processing of HTTP proxy requests for telnet and smb URIs.
Compare with curl's recorded outcome
Known vulnerability
A real vulnerability: CVE-2022-43552 HTTP Proxy deny use after free
Shown for comparison after analysis. The pipeline did not see this label.
ProveIt's finding
The available evidence does not settle the report. A maintainer should investigate.
Why this finding?
- The deterministic check indicates the issue exists in curl at revision ec4eec222b4c (master on 2022-11-07), making the report plausible.
- However, no curl source code was provided for this revision, so none of the claims can be verified against the actual implementation.
- The report provides specific command lines that allegedly trigger the issue, but without the URL parsing, proxy CONNECT handling, and protocol-specific code (telnet, smb), the code path cannot be confirmed.
- A human reviewer should examine the relevant source files at the given revision to confirm the use-after-free and its reachability.
What still needs checking
- curl source code at revision ec4eec222b4c, particularly: lib/http_proxy.c (proxy CONNECT handling), lib/url.c (URL parsing for telnet:// and smb:// with bracket notation), lib/telnet.c, lib/smb.c, and any connection setup/teardown code that might free memory prematurely.
How this analysis ran 6 claims · 0 citations verified
Checked against curl master on 2022-11-07 (ec4eec222b4c). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.
Review a draft reply to the reporter
Edit and verify before sending.
Thank you for the report. The deterministic check confirms an issue exists at the reported revision, but we need to examine the source code to verify the use-after-free and its trigger. Please provide the relevant source files (http_proxy.c, url.c, telnet.c, smb.c) from revision ec4eec222b4c, or confirm if the issue persists in a newer release so we can review the current code.
Inspect all claims and source code 6 claims · 0 code excerpts
Report claims
libcurl uses already freed heap-memory when processing HTTP proxy requests for telnet URIs
Read the reasoning
No curl source code was provided for revision ec4eec222b4c. The claim describes a use-after-free in HTTP proxy handling for telnet URIs, but without the relevant source files (likely lib/http_proxy.c, lib/url.c, or protocol-specific handlers), the claim cannot be verified against the code.
libcurl uses already freed heap-memory when processing HTTP proxy requests for smb URIs
Read the reasoning
No curl source code was provided. The claim describes a use-after-free in HTTP proxy handling for smb URIs, but without the relevant source files, the claim cannot be verified against the code.
Command line: ./src/curl 0 -x0:80 telnet:/[j-u][j-u]//0 -m 01
Read the reasoning
This is a trigger claim providing a command line. Without the curl source code to trace how this command line is parsed and handled (particularly the telnet:// URI with IPv6-like brackets and the -x proxy option), it cannot be determined whether this command actually reaches the alleged flaw.
Command line: ./src/curl 0 -x0:80 smb:/[j-u][j-u]//0 -m 01
Read the reasoning
Same as C3: trigger claim with a command line for smb:// URI. Without source code to trace the parsing and proxy CONNECT handling, verifiability is not possible.
Use after free occurs for both read and write operations
Read the reasoning
Impact claim about read and write use-after-free. No source code provided to confirm the memory access patterns after free.
Run the command with valgrind to detect use-after-free
Read the reasoning
Reproduction claim suggesting valgrind. Without the ability to run the code or examine the allocation/free sites in the source, this cannot be verified.
Read the original report
Source code
No source code was retrieved for this analysis. The evidence may be incomplete.