""" ======================================================================== CVE-2024-56406 CPAN Security Group ======================================================================== CVE ID: CVE-2024-56406 Distribution: perl Versions: from 5.40.0 until 5.40.2 from 5.38.0 until 5.38.4 from 5.36.0 through 5.36.3 from 5.34.0 through 5.34.3 MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5/ Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes Description ----------- A heap buffer overflow vulnerability was discovered in Perl. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses. Problem types ------------- CWE-122 Heap-based Buffer Overflow CWE-787 Out-of-bounds Write Mitigations ----------- Users should update perl to 5.40.2 or 5.38.4, or apply the upstream patch provided in the References section. References ---------- https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch https://metacpan.org/release/SHAY/perl-5.38.4/changes https://metacpan.org/release/SHAY/perl-5.40.2/changes Credits ------- Nathan Mills, finder """
Quick fix for perl-5.40.0-r1 root# cat /etc/portage/patches/dev-lang/perl-5.40.0-r1/perl-5.40.0-fixbuff.patch diff --git a/op.c b/op.c index 69ff030e88eb..298b2926338a 100644 --- a/op.c +++ b/op.c @@ -6881,6 +6881,7 @@ S_pmtrans(pTHX_ OP *o, OP *expr, OP *repl) * same time. But otherwise one crosses before the other */ if (t_cp < 256 && r_cp_end > 255 && r_cp != t_cp) { can_force_utf8 = TRUE; + max_expansion = MAX(2, max_expansion); } } root# cd /var/db/repos/gentoo/dev-lang/perl/ && ebuild perl-5.40.0-r1.ebuild manifest && emerge perl
The vulnerability has a high severity rating: https://www.tenable.com/cve/CVE-2024-56406
