Bug 2292350 (CVE-2024-35325) - CVE-2024-35325 libyaml: double-free in yaml_event_delete in /src/libyaml/src/api.c
Summary: CVE-2024-35325 libyaml: double-free in yaml_event_delete in /src/libyaml/src/...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2024-35325
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2292358 2292357 2292359 2292360
Blocks: 2292349
TreeView+ depends on / blocked
 
Reported: 2024-06-14 06:04 UTC by Rohit Keshri
Modified: 2025-05-02 15:52 UTC (History)
47 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-08-02 13:19:47 UTC
Embargoed:

Attachments (Terms of Use)

Description Rohit Keshri 2024-06-14 06:04:51 UTC 
A vulnerability was found in libyaml up to 0.2.5. Affected by this issue is the function yaml_event_delete of the file /src/libyaml/src/api.c. The manipulation leads to a double-free.

https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35325.c
Comment 1 Rohit Keshri 2024-06-14 06:17:02 UTC 
Created R-yaml tracking bugs for this issue:

Affects: fedora-all [bug 2292359]


Created ghc-yaml tracking bugs for this issue:

Affects: epel-all [bug 2292358]


Created libyaml tracking bugs for this issue:

Affects: fedora-all [bug 2292357]


Created python-ruamel-yaml-clib tracking bugs for this issue:

Affects: fedora-all [bug 2292360]
Comment 3 Lumír Balhar 2024-08-01 10:53:02 UTC 
The author of libyaml thinks it's a misuse of the API, not a vulnerability: https://github.com/yaml/libyaml/issues/303
Comment 4 Major Hayden 🤠 2024-08-02 13:19:47 UTC 
Per the upstream developer, this involves a misuse of the underlying C API which is not necessary and not documented:

https://github.com/yaml/libyaml/issues/297#issuecomment-2161577994
Note You need to log in before you can comment on or make changes to this bug.