[Critical] Curl CVE-2023-38545 vulnerability code changes are disclosed on the internet
What the report claims
The report claims that an integer overflow in curl_easy_setopt() can be exploited to execute arbitrary code, and that this flaw was fixed in curl 8.4.0 by checking the timeout argument before passing it to the internal curl function.
Compare with curl's recorded outcome
Labeled AI slop
curl's maintainer lists this report as AI slop
Shown for comparison after analysis. The pipeline did not see this label.
ProveIt's finding
Key code references could not be verified in the targeted curl version.
Why this finding?
- The reported vulnerable function curl_easy_setopt() with CURLOPT_TIMEOUT overflow handling does not exist in curl. The actual implementation at lib/setopt.c:3191-3205 only validates the data pointer and calls Curl_vsetopt.
- The fix functions curl_easy_setopt_timeout and curl_easy_setopt_custom cited in the report do not exist in any curl release since 7.50 per deterministic checks.
- The report's code snippet appears fabricated; no integer overflow vulnerability exists in the real curl_easy_setopt.
- The claimed CVE-2023-38545 fix commit 9414975 and version 8.4.0 are not reflected in the provided source code at the checked revision.
How this analysis ran 5 claims · 5 citations verified
Checked against curl master on 2023-10-10 (f64ecb2bc0db). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.
Review a draft reply to the reporter
Edit and verify before sending.
The code you describe for curl_easy_setopt() and its fix does not exist in curl. The actual function at lib/setopt.c:3191-3205 only checks for a null handle and delegates to Curl_vsetopt — there is no CURLOPT_TIMEOUT case, no timeout extraction, and no overflow check. The helper functions curl_easy_setopt_timeout and curl_easy_setopt_custom are not present in any curl release. Please provide a concrete reproduction against a real curl version, or clarify which function and version you are referring to.
Inspect all claims and source code 5 claims · 1 code excerpts
Report claims
integer overflow in curl_easy_setopt()
Read the reasoning
The report claims an integer overflow in curl_easy_setopt() when handling CURLOPT_TIMEOUT with a crafted timeout value. The actual source code at lib/setopt.c:3191-3205 shows a completely different function that takes (struct Curl_easy *data, CURLoption tag, ...), checks only for null data pointer, and delegates to Curl_vsetopt. There is no switch statement, no CURLOPT_TIMEOUT case, no timeout variable extraction, and no overflow check. The deterministic checks confirm curl_easy_setopt_timeout and curl_easy_setopt_custom do not exist in any curl release since 7.50, contradicting the reported fix code.
curl_easy_setopt() function
Read the reasoning
While curl_easy_setopt exists, its implementation (lib/setopt.c:3191-3205) does not match the report's description. The report describes a function with a switch on option handling CURLOPT_TIMEOUT by extracting a long timeout and checking for overflow. The real function has none of that.
passing a crafted timeout value that causes overflow
Read the reasoning
The trigger claims an attacker can pass a crafted timeout value causing overflow. The actual code path shows curl_easy_setopt does not extract or validate any timeout value; it passes the va_list directly to Curl_vsetopt. No such attack surface exists in the provided code.
arbitrary code execution or denial of service
Read the reasoning
Since the claimed integer overflow vulnerability does not exist in the actual curl_easy_setopt implementation, the claimed impact of arbitrary code execution or denial of service has no basis in the provided code.
searching Bard for the vulnerability and using disclosed commit details to craft an exploit
Read the reasoning
The reproduction claim describes searching an AI (Bard) for undisclosed vulnerability information and using commit details to craft an exploit. This is not a verifiable code path in curl; it describes the reporter's research method. The commit 9414975 and the described fix code are not present in the provided repository state.
Deterministic checks that failed
- symbol curl_easy_setopt_timeout does not exist in any curl release since 7.50
- symbol curl_easy_setopt_custom does not exist in any curl release since 7.50
Read the original report (excerpt)
Source code
| 3191 | CURLcode curl_easy_setopt(struct Curl_easy *data, CURLoption tag, ...) |
| C1: Actual curl_easy_setopt implementation shows no integer overflow handling for CURLOPT_TIMEOUT; it only validates data pointer and calls Curl_vsetopt | |
| C2: Function exists but signature and body differ entirely from report's description | |
| C3: No timeout parameter extraction or validation occurs in curl_easy_setopt | |
| C4: No vulnerability exists in the actual function to enable code execution or DoS | |
| 3192 | { |
| 3193 | va_list arg; |
| 3194 | CURLcode result; |
| 3195 | |
| 3196 | if(!data) |
| C1: Only check is if(!data) return CURLE_BAD_FUNCTION_ARGUMENT; no timeout variable or overflow check exists | |
| 3197 | return CURLE_BAD_FUNCTION_ARGUMENT; |
| 3198 | |
| 3199 | va_start(arg, tag); |
| 3200 | |
| 3201 | result = Curl_vsetopt(data, tag, arg); |
| 3202 | |
| 3203 | va_end(arg); |
| 3204 | return result; |
| 3205 | } |