Описание
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
A stack-based buffer overflow vulnerability was found in the S_find_uninit_var() function in sv.c in Perl. This issue may allow an authenticated local attacker to send a specially crafted request to the application, leading to an infinite recursion, exhausting the process' stack space, resulting in a denial of service.
Отчет
The vulnerable code was introduced in Perl v5.33.1. Red Hat Enterprise Linux ships Perl v5.32.1 and lower. Our code-base does not contain the vulnerable code, therefore, RHEL is not affected. When attempting to access a hash entry with an undefined variable as the key, an infinite recursion occurs, depleting the stack space and leading to a stack overflow. This behavior is specific to cases where '-w' ("use warnings;") are enabled.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | perl | Not affected | ||
| Red Hat Enterprise Linux 7 | perl | Not affected | ||
| Red Hat Enterprise Linux 8 | perl | Not affected | ||
| Red Hat Enterprise Linux 8 | perl:5.30/perl | Not affected | ||
| Red Hat Enterprise Linux 8 | perl:5.32/perl | Not affected | ||
| Red Hat Enterprise Linux 9 | perl | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based c ...
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
Уязвимость функции S_find_uninit_var (sv.c) интерпретатора Perl, позволяющая нарушителю выполнить произвольный код
EPSS
5.5 Medium
CVSS3