Bug 1838000 (CVE-2020-12723) - CVE-2020-12723 perl: corruption of intermediate language state of compiled regular expression due to recursive S_study_chunk() calls leads to DoS
Summary: CVE-2020-12723 perl: corruption of intermediate language state of compiled re...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-12723
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1839278 1839279 1839280 1844664 1909860 1929870 1933098 1938330 1945144
Blocks: 1838017
TreeView+ depends on / blocked
 
Reported: 2020-05-20 11:01 UTC by msiddiqu
Modified: 2021-06-22 12:21 UTC (History)
17 users (show)

Fixed In Version: perl 5.30.3, perl 5.28.3
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-02-02 14:41:45 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0343 0 None None None 2021-02-02 12:04:37 UTC
Red Hat Product Errata RHSA-2021:0557 0 None None None 2021-02-16 14:37:16 UTC
Red Hat Product Errata RHSA-2021:0883 0 None None None 2021-03-16 14:56:05 UTC

Description msiddiqu 2020-05-20 11:01:33 UTC
This vulnerability is an attacker controlled corruption of the
intermediate language state of a compiled regular expression. The
corruption occurs when Perl's regular expression compiler calls
S_study_chunk() in a recursive fashion to optimize the intermediate
language representation of a regular expression. An attacker could abuse
this behavior to insert instructions into the compiled form of a Perl
regular expression.

Comment 1 msiddiqu 2020-05-20 11:01:38 UTC
Acknowledgments:

Name: Sergey Aleynikov

Comment 7 Petr Pisar 2020-05-25 07:02:14 UTC
(In reply to Todd Cullum from comment #4)
> Mitigation:
> 
> To mitigate this flaw, developers should not pass untrusted or uncontrolled
> data to the Perl regular expression engine; especially in cases where the
> regular expression is used in input sanitization, validation, or filtering.

This flaw is about compiling an untrusted regular expression. Not about matching an untrusted text.

Comment 8 Todd Cullum 2020-05-27 18:27:14 UTC
Mitigation:

To mitigate this flaw, developers should not allow untrusted regular expressions to be compiled by the Perl regular expression compiler.

Comment 9 Todd Cullum 2020-05-27 21:59:20 UTC
This flaw is caused by code in the S_study_chunk() routine of regcomp.c which handles the GOSUB regopcode. S_study_chunk() performs recursive calls which could mutate data that an outer call was already working on, when handling a GOSUB opcode. Upstream's patch has added booleans called in_gosub, mutate_ok, and was_mutate_ok which are set and checked before mutations occur to ensure that the current recursion depth does not mutate data being worked on by an outer frame. Instead, the outer frame should handle the mutation to avoid corrupting the intermediate language representation of the regular expression and the possibility of an attacker inserting instructions into compiled Perl regular expressions.

Comment 13 msiddiqu 2020-06-06 01:38:44 UTC
Created perl tracking bugs for this issue:

Affects: fedora-all [bug 1844664]

Comment 19 errata-xmlrpc 2021-02-02 12:05:19 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0343 https://access.redhat.com/errata/RHSA-2021:0343

Comment 20 Product Security DevOps Team 2021-02-02 14:41:45 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-12723

Comment 21 errata-xmlrpc 2021-02-16 14:37:13 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0557 https://access.redhat.com/errata/RHSA-2021:0557

Comment 25 errata-xmlrpc 2021-03-16 14:56:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Extended Update Support

Via RHSA-2021:0883 https://access.redhat.com/errata/RHSA-2021:0883

Comment 26 errata-xmlrpc 2021-03-30 09:31:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2021:1032 https://access.redhat.com/errata/RHSA-2021:1032

Comment 27 errata-xmlrpc 2021-04-20 12:53:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2021:1266 https://access.redhat.com/errata/RHSA-2021:1266

Comment 28 errata-xmlrpc 2021-06-02 00:46:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:2184 https://access.redhat.com/errata/RHSA-2021:2184


Note You need to log in before you can comment on or make changes to this bug.