[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250413144759.GA18912@openwall.com>
Date: Sun, 13 Apr 2025 16:47:59 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Stig Palmquist <stig@...g.io>
Subject: Re: CVE-2024-56406: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
Hi Stig,
Thank you for handling this disclosure so well!
On Sun, Apr 13, 2025 at 03:23:25PM +0200, Stig Palmquist wrote:
> Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow
> when transliterating non-ASCII bytes
>
> Description
> -----------
> A heap buffer overflow vulnerability was discovered in Perl.
>
> When there are non-ASCII bytes in the left-hand-side of the `tr`
> operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
>
> $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'
> Segmentation fault (core dumped)
Running this command on distro packages based on 5.32.1 (like in EL9)
does not segfault (produces no output), which is as expected for a
version that didn't yet have the bug (and assuming no bug backport).
> https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch
As it was mentioned in the advance notification to distros, the issue
was introduced in:
https://github.com/Perl/perl5/commit/a311ee08b6781f83a7785f578a26bbc21a7ae457
which is part of tags v5.33.1 to v5.41.10, so I guess those versions are
also affected. The fix commit is effectively a revert of the bug commit.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
