✓ProveIt
Examples / Report #2954286 Saved analysis

CVE-2025-0665: eventfd double close

curl · 2025-01-228.4s analysis · $0.008 in model calls

What the report claims

Potential for attacker control of arbitrary file descriptors via a double close in libcurl 8.11.1, leading to remote code execution or sensitive data leakage.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2025-0665 eventfd double close

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

More detail needed

There is not enough information to verify the reported bug.

Why this finding?
  • No curl source code was provided for the target revision (7e814c871793, master on 2025-01-22). The curl_source section explicitly states '(no curl code could be retrieved for this report)'.
  • All claims depend on examining the eventfd implementation (likely in lib/eventfd.c or similar) to check for double-close bugs and thread-safety guards, but that code is absent.
  • Without the code, it is impossible to verify whether a double close exists, whether it is reachable in multi-threaded scenarios, or whether the described race condition is feasible.
What still needs checking
  • The eventfd implementation source code (e.g., lib/eventfd.c) from libcurl 8.11.1 or the checked revision 7e814c871793.
  • Any fix commits referenced by the reporter ('A fix already exists for this') to understand what was changed.
How this analysis ran 5 claims · 0 citations verified

Checked against curl master on 2025-01-22 (7e814c871793). Test evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding
grounded
no model · 1 references checked out, 0 did not
2 · Claims
NVIDIA-Nemotron-3-Nano-30B-A3B
5 claims · 1430 tokens · $0.0002
3 · Evidence
0 code snippets
real curl source at 7e814c871793
4 · Judgment
Nemotron-3-Ultra-550b-a55b
4440 tokens · 5.8s · $0.0073
5 · Receipts
0 of 0 citations verified
every citation must point at code the judge was shown
Review a draft reply to the reporter

Edit and verify before sending.

Thank you for reporting this. We cannot evaluate the claim because the relevant curl source code (eventfd implementation) was not retrieved for the target revision. Please provide a link to the specific file and function you believe contains the double close, or the GitHub issue #15725 if it contains code excerpts. With the code, we can check for missing fd validity checks before close() calls and thread-safety guards.

Inspect all claims and source code 5 claims · 0 code excerpts

Report claims

C1flaw not verifiable

double close in libcurl 8.11.1

Read the reasoning

No curl source code was provided for the revision checked (7e814c871793). The report mentions 'eventfd' but the relevant files (likely lib/eventfd.c or similar) are not in the provided context, so I cannot verify whether a double close exists.

C2location not verifiable

in multi threaded code

Read the reasoning

The claim that the flaw is 'in multi threaded code' cannot be assessed without seeing the actual eventfd implementation and its thread-safety mechanisms.

C3trigger not verifiable

three threads, one writing a sensitive file (writer), one listening for outside connections (listener), and one using curl (curl thread)

Read the reasoning

This describes a hypothetical race condition scenario. Without the actual curl code showing how eventfd file descriptors are managed, closed, and protected against reuse, I cannot verify if this sequence is possible.

C4impact not verifiable

Potential for attacker control of arbitrary file descriptors, provided a race condition. Potential for remote code execution, or leaking of sensitive information.

Read the reasoning

Impact claims depend on the existence and reachability of the double-close flaw (C1), which cannot be verified without the source code.

C5reproduction not verifiable

Steps To Reproduce: 1. Have three threads... 2. The curl thread uses curl... 3. The writer opens the sensitive file... 4. The curl thread gets to the second close... 5. The listener accepts a connection... 6. The writer begins writing sensitive data to descriptor X

Read the reasoning

Reproduction steps assume the double-close flaw exists. Without the code, I cannot confirm the steps would actually trigger the vulnerability.

Read the original report

Full report on HackerOne ↗

## Summary: GitHub issue 15725 describes a double close in libcurl 8.11.1. I believe that a double close in multi threaded code should be considered a security vulnerability. A fix already exists for this, so it should be good in the next release. I am not 100% sure this is the place to be making such a comment, but I felt it was better make this private rather than commenting about it on GitHub. I do not want a reward for a bug which I was not the first to find, I just want the software I use and create to be secure. ## Affected version libcurl 8.11.1 ## Steps To Reproduce: 1. Have three threads, one writing a sensitive file (writer), one listening for outside connections (listener), and one using curl (curl thread). 2. The curl thread uses curl, and gets to the first of the two closes. It closes file descriptor X. 3. The writer opens the sensitive file. This file could be a script, a password file, a configuration file, or any other file containing sensitive data. The open file is assigned file descriptor X. 4. The curl thread gets to the second close, closing file descriptor X again. 5. The listener accepts a connection from the attacker. This connection is then assigned the file descriptor X. 6. The writer begins writing (or continues to write) sensitive data to descriptor X, which would now be sent to the attacker. A similar condition could cause the reading data from an attacker controlled stream, rather than a trusted file. ## Supporting Material/References: https://github.com/curl/curl/issues/15725 ## Impact ## Summary: Potential for attacker control of arbitrary file descriptors, provided a race condition. Potential for remote code execution, or leaking of sensitive information.

Source code

No source code was retrieved for this analysis. The evidence may be incomplete.