[LFS Trac] #5703: perl-5.40.2

#5703: perl-5.40.2
-----------------------------+----------------------
 Reporter:  Douglas R. Reno  |      Owner:  lfs-book
     Type:  enhancement      |     Status:  new
 Priority:  highest          |  Milestone:  12.4
Component:  Book             |    Version:  git
 Severity:  normal           |   Keywords:
-----------------------------+----------------------
 New point version

 This is a security release for a vulnerability that allows for a heap
 buffer overflow.

 {{{
 ========================================================================
 CVE-2024-56406                                       CPAN Security Group
 ========================================================================

         CVE ID:  CVE-2024-56406
   Distribution:  perl
       Versions:  from 5.40.0 until 5.40.2
                  from 5.38.0 until 5.38.4
                  from 5.36.0 through 5.36.3
                  from 5.34.0 through 5.34.3

       MetaCPAN:  https://metacpan.org/dist/perl
       VCS Repo:  https://github.com/Perl/perl5/


 Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow
 when transliterating non-ASCII bytes

 Description
 -----------
 A heap buffer overflow vulnerability was discovered in Perl.

 When there are non-ASCII bytes in the left-hand-side of the `tr`
 operator, `S_do_trans_invmap` can overflow the destination pointer `d`.

    $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'
    Segmentation fault (core dumped)

 It is believed that this vulnerability can enable Denial of Service and
 possibly Code Execution attacks on platforms that lack sufficient
 defenses.

 Problem types
 -------------
 CWE-122 Heap-based Buffer Overflow
 CWE-787 Out-of-bounds Write

 Mitigations
 -----------
 Users should update perl to 5.40.2 or 5.38.4, or apply the upstream
 patch provided in the References section.

 References
 ----------
 https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch
 https://metacpan.org/release/SHAY/perl-5.38.4/changes
 https://metacpan.org/release/SHAY/perl-5.40.2/changes

 Credits
 -------
 Nathan Mills, finder



 --
 Stig Palmquist
 }}}

 Systems that are impacted will have a segmentation fault when running the
 following command:

 perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'

 On an LFS 12.3 system, that returns:


 {{{
 renodr [ /sources ]$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'
 Segmentation fault (core dumped)
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/5703>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page