Bug 2292351 - libyaml: double-free in yaml_emitter_emit in /src/libyaml/src/emitter.c
Summary: libyaml: double-free in yaml_emitter_emit in /src/libyaml/src/emitter.c
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2292353 2292352 2292354 2292355
Blocks: 2292349
TreeView+ depends on / blocked
 
Reported: 2024-06-14 06:05 UTC by Rohit Keshri
Modified: 2024-12-16 18:43 UTC (History)
34 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-08-02 13:19:34 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github yaml libyaml issues 301 0 None open CVE-2024-35326 2024-07-17 07:35:33 UTC

Description Rohit Keshri 2024-06-14 06:05:18 UTC 
libyaml v0.2.5 is vulnerable to Buffer Overflow. Affected by this issue is the function yaml_emitter_emit of the file /src/libyaml/src/emitter.c. The manipulation leads to a double-free.

https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35326.c
Comment 1 Rohit Keshri 2024-06-14 06:15:52 UTC 
Created R-yaml tracking bugs for this issue:

Affects: fedora-all [bug 2292354]


Created ghc-yaml tracking bugs for this issue:

Affects: epel-all [bug 2292353]


Created libyaml tracking bugs for this issue:

Affects: fedora-all [bug 2292352]


Created python-ruamel-yaml-clib tracking bugs for this issue:

Affects: fedora-all [bug 2292355]
Comment 3 Lumír Balhar 2024-07-17 07:35:33 UTC 
Upstream report: https://github.com/yaml/libyaml/issues/301
Comment 4 Major Hayden 🤠 2024-08-02 13:19:34 UTC 
Per the upstream developer, this involves a misuse of the underlying C API which is not necessary and not documented:

https://github.com/yaml/libyaml/issues/297#issuecomment-2161577994
Note You need to log in before you can comment on or make changes to this bug.