CVEs-PoC/2021/CVE-2021-22945.md

### [CVE-2021-22945](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22945)
![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=curl%207.73.0%20to%20and%20including%207.78.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Double%20Free%20(CWE-415)&color=brightgreen)

### Description

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.

### POC

#### Reference
- https://www.oracle.com/security-alerts/cpuoct2021.html

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Icare741/TPTrivy
- https://github.com/blairdrummond/terragrunt-experiment-demo-app
- https://github.com/devopstales/trivy-operator
- https://github.com/emilkje/trivy-operator-lab
- https://github.com/gatecheckdev/gatecheck
- https://github.com/kenlavbah/log4jnotes