# CVE-2021-22925: TELNET stack contents disclosure again

Incomplete fix for curl TELNET NEW_ENV parsing lets a short-name/long-value option overflow the len counter, leaking uninitialized stack memory to the server.

- Payout: hidden
- Severity: low
- Program: curl
- Found by: thoger
- Disclosed: 2021-07-21
- CVE: CVE-2021-22925, CVE-2021-22898
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1223882
- Library page: https://bugbountylibrary.com/r/h1%3A1223882
- Tags: area:devices domain:network impact:data-leak kind:bounty platform:hackerone sev:low tech:curl technique:incomplete-fix technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** lib/telnet.c NEW_ENV option parsing (telnet:// client)
**Root cause:** check_telnet_options increments len by tmplen (original unparsed length) instead of the truncated strlen(varname)+strlen(varval)+2 actually written by msnprintf, so a truncated varval leaves a gap of uninitialized temp[] memory.
**Steps:**
1. Run `curl telnet://127.0.0.1:23 -t NEW_ENV=$(python -c "print('a,' + 'b'*256)")` against a listening telnet server.
2. sscanf parses short varname 'a' and truncated varval, returning 2 so the option is not skipped.
3. msnprintf writes truncated data to temp[] but len is advanced by tmplen, creating an uninitialized gap.
4. Server receives the temp[] buffer including leaked stack bytes.
**How found:** Reviewed the prior CVE-2021-22898 fix commit and noticed it only handled long variable names; tested the advisory's own example of short name with long value and traced sscanf return value vs len accounting in check_telnet_options.
**Exploitation:** Attacker controls the telnet server or observes traffic; the client sends uninitialized stack contents embedded in the NEW_ENV option to the server, disclosing memory.
**Insight:** When auditing a patch for a memory disclosure, test the exact example from the advisory plus the inverse shape (swap which field is long); check that length counters are updated from actual bytes written, not from pre-truncation input length.