search

yaml / libyaml

Canonical source repository for LibYAML
http://pyyaml.org/wiki/LibYAML
MIT License
921 stars 312 forks source link

How is this CVE-2024-3205 affected? #289

Closed zhuofeng6 closed 1 month ago

zhuofeng6 commented 3 months ago

https://nvd.nist.gov/vuln/detail/CVE-2024-3205

hasufell commented 3 months ago

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

hasufell commented 3 months ago

Code:

https://github.com/yaml/libyaml/blob/f8f760f7387d2cc56a2fc7b1be313a3bf3f7f58c/src/emitter.c#L740-L788

zhuofeng6 commented 3 months ago

Is this pr to fix the CVE? https://github.com/yaml/libyaml/pull/259

zhuofeng6 commented 3 months ago

Code:

https://github.com/yaml/libyaml/blob/f8f760f7387d2cc56a2fc7b1be313a3bf3f7f58c/src/emitter.c#L740-L788

Where exactly is this memory leak?

perlpunk commented 3 months ago

It's hard to review a PR if there is no reproducer I guess...

hasufell commented 3 months ago

@perlpunk there's supposedly evidence in the fuzzing data https://drive.google.com/drive/folders/1lwNEs8wqwkUV52f3uQNYMPrxRuXPtGQs?usp=sharing

I haven't checked yet

perlpunk commented 3 months ago

At least I can download some files from the shared drive, but the two input files I can find there have nothing to do with flow sequences. Also seem to be broken. This is one of the files (I removed some broken stuff at the beginning that the parser complained about):

- -  - - -   - - - -     - - - - - -   - - -  - -  -     - - -   - - - -     - - - - - - -  -  - - - - ---   -     -  -- - -     - - -     - - - - - - -  -  -  - - - -     -  --   -  - 
-  - - -    - - - -   - - -  - - - -     - - -   - - - - -   - - - -     -     - - - - - - -  -  -  - - - -     - - -   -  - 
-  - - -    - - - -   - - -  - - - -     - - -   - - - - -   - - - -     - -    - - -     - - - - - -   - - -  - -  -     - - -   - -- -   - - - -       --  -
perlpunk commented 3 months ago

Please see my notes in #258 how I tried to reproduce (and failed)

zhuofeng6 commented 3 months ago

I think this can only be a bug, not a cve. After all, it's common.

What do you think, my brother @perlpunk

perlpunk commented 3 months ago

brother?

perlpunk commented 3 months ago

Please see my latest comment here: https://github.com/yaml/libyaml/issues/258#issuecomment-2058613931 I believe it's not a libyaml vulnerability or bug.

perlpunk commented 1 month ago

I contacted VulDB and https://www.cve.org/CVERecord?id=CVE-2024-3205 has been rejected now. Closing.