Описание
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.
The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.
A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.
A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution.
Отчет
This flaw has a Moderate impact. Perl's regular expression engine contains a signed 32-bit integer overflow in the superlinear-cache size calculation (S_regmatch) that can cause out-of-bounds heap reads and writes during regex matching. Triggering it requires an application to match an attacker-controlled subject of roughly 273 MiB against a pattern containing at least 15 participating WHILEM nodes, so attack complexity is high. Successful exploitation most likely results in a process crash (denial of service); the out-of-bounds access is bit-granular into a cache bitmap, so controlled memory corruption or arbitrary code execution has not been demonstrated. Given the large, unusual inputs required and the limited reachability of the vulnerable path, Red Hat has deferred fixing this issue; residual risk is limited to a potential denial of service in applications matching very large untrusted inputs against complex patterns.
Меры по смягчению последствий
Applications can reduce exposure by limiting the size of untrusted input passed to regular-expression matching (the overflow requires a subject on the order of 273 MiB) and by avoiding matching untrusted data against highly complex patterns.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | perl | Fix deferred | ||
| Red Hat Enterprise Linux 6 | perl | Fix deferred | ||
| Red Hat Enterprise Linux 7 | perl | Fix deferred | ||
| Red Hat Enterprise Linux 8 | perl | Fix deferred | ||
| Red Hat Enterprise Linux 8 | perl:5.32/perl | Fix deferred | ||
| Red Hat Enterprise Linux 9 | perl | Fix deferred | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 | Under investigation | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Under investigation | ||
| Red Hat OpenShift Dev Spaces | devspaces/code-rhel9 | Under investigation | ||
| Red Hat Hardened Images | perl-main-1.03-525.1.hum1 | Fixed | RHSA-2026:63403 | 03.09.2026 |
Показывать по
Дополнительная информация
Статус:
5.7 Medium
CVSS3
Связанные уязвимости
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch
Perl versions through 5.45.1 have out-of-bounds heap reads and writes ...
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.
5.7 Medium
CVSS3