curl security by Daniel Stenberg from curl up 2024
•
0 likes•2 views
The state of curl security in 2024 from curl up 2024.
Recommended
Recommended
More Related Content
More from Daniel Stenberg
More from Daniel Stenberg (20)
Recently uploaded
Recently uploaded (20)
curl security by Daniel Stenberg from curl up 2024
- 2. Things to mention Security team Hackerone Vulnerabilities C mistakes CVEs CNA @bagder
- 3. The curl Security Team Dan Fandrich Daniel Gustafsson Daniel Stenberg James Fuller @bagder Kamil Dudka Max Dymond Stefan Eissing Viktor Szakats
- 4. Hackerone (April 24 2023 - April 24 2024) submissions: 97 confirmed vulnerabilities: 11 Average time to first response: 1 h Median time to first response: 0 h Median time to triage: 7 h @bagder
- 5. Hackerone in total submissions: 439 confirmed vulnerabilities: 69 (15.7%) “informative”: 86 (19.5%) Average time to first response: 1 h Median time to first response: 0 h @bagder
- 11. @bagder only 3 severity high vulnerabilities during the last 5 years
- 12. CVE and CNA 20 curl CVE IDs published since March 20, 2023 latest verified report: March 14, 2024 Bogus CVEs All CVE data provided as JSON (OSV scheme) curl is a CNA since January 16, 2024 Part of the OSS CNA Users Group @bagder DAYS SINCE LAST REPORT 51
- 14. @bagder C
- 15. C mistakes Manually assessed OVERFLOW, OVERREAD, DOUBLE_FREE, USE_AFTER_FREE, NULL_MISTAKE and UNINIT Likely to have been avoided should we have used a memory-safe language Less than 40% of all vulnerabilities to date @bagder
- 16. C mistake mitigations Input strings have a max length (8MB) Avoid (str|strn|mem)cpy - use helper functions Avoid (re|c|m)alloc - use helper functions Plus more tests, more analyzers and more fuzzing of course @bagder
- 19. Lessons from past vulnerabilities C mistake mitigations might have an effect Flaws linger in the code a very long time until detected Fuzzing is king Fixing flaws is usually straightforward We are never “done” (“rust in curl” is a separate session) @bagder
- 20. @bagder 78,100 USD bug-bounty in total +25,680 (+48.9%) USD since last year
- 22. Take-aways from xz Reproducible tarballs (using containers) Push for more signed commits? Some say “not generate tarballs” @bagder