# CVE-2021-22898: TELNET stack contents disclosure

libcurl telnet suboption() checked sscanf truthiness instead of ==2, leaving uninitialized stack gaps in the NEW_ENV output that leak memory to the peer.

- Payout: hidden
- Severity: medium
- Program: curl
- Found by: nyymi
- Disclosed: 2021-05-26
- CVE: CVE-2021-22898
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1176461
- Library page: https://bugbountylibrary.com/r/h1%3A1176461
- Tags: area:oss domain:oss impact:data-leak kind:bounty platform:hackerone sev:medium tech:curl technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** libcurl telnet suboption NEW_ENV handling (lib/telnet.c)
**Root cause:** `if(sscanf(v->data, "%127[^,],%127s", varname, varval))` accepts a single-field match, so varval keeps its previous value while temp advances by strlen(v->data)+1, leaving uninitialized gaps in the output buffer.
**Steps:**
1. Start a telnet service and capture with `tcpdump -i lo -X -s 65535 port 23`.
2. Run curl with multiple `-tNEW_ENV=<128 a's>,<128 a's>` options against `telnet://127.0.0.1`.
3. Observe the IAC SB NEW_ENV suboption payload in the capture containing stack pointers/gaps between the 'a' runs.
**How found:** Code reading of suboption(): noticed sscanf return value used as boolean rather than compared to 2, combined with temp advancing by strlen(v->data)+1, implying uninitialized gaps.
**Exploitation:** Attacker who controls CURLOPT_TELNETOPTIONS and can sniff the telnet traffic or choose the server/port reads up to ~half of the 2048-byte temp buffer of stale stack memory (e.g. keys in setuid or PHP-curl contexts).
**Insight:** When auditing sscanf/format-parsing, check the return value is compared to the exact expected field count; partial matches leave destination buffers stale, and any subsequent length computed from the input (not the parsed output) creates uninitialized-memory disclosure.