PT-2024-21108 · Yyjson · Yyjson

Alsoprach · Published 2024-02-10 · Updated 2025-09-17 · CVE-2024-25713

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions yyjson versions 0.8.0 and earlier

Description The issue is related to a double free vulnerability in the pool series allocator, specifically due to the lack of loop checks in the pool free function. This can lead to remote code execution in some cases. The vulnerability is caused by the pool free function not performing pointer destruction, resulting in Use-After-Free (UAF) vulnerabilities. Arbitrary address writing, combined with other legitimate or illegitimate operations of programs using this library, can lead to remote code execution.

Recommendations For yyjson versions 0.8.0 and earlier, consider applying the defensive patch provided by the developer, which will cause the program to crash immediately if yyjson mut doc free() is called twice on the same doc, alerting to the incorrect usage. As a temporary workaround, ensure that yyjson mut doc free() is not called multiple times on the same document to prevent the double free vulnerability.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-25713

GHSA-Q4M7-9PCM-FPXH

GHSA-WHX6-M9J4-W2M2

Affected Products

Yyjson

References · 17

• https://github.com/ibireme/yyjson/security/advisories/GHSA-q4m7-9pcm-fpxh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25713 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KQ67T4R7QEWURW5NMCCVLTBASL4ECHE · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-whx6-m9j4-w2m2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25713 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6KQ67T4R7QEWURW5NMCCVLTBASL4ECHE · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TKQPEREDUDKGYJMFNFDQVYCVLWDRO2Y2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TKQPEREDUDKGYJMFNFDQVYCVLWDRO2Y2 · Vendor Advisory
• https://github.com/ibireme/yyjson/commit/0eca326fe57aeeb866e6f04c9ef9ea9f8343157e · Note
• https://github.com/ibireme/yyjson · Note
• https://t.me/cveNotify/135720 · Telegram Post
• https://twitter.com/CVEnew/status/1756505138984800394 · Twitter Post
• https://t.me/cvenotify/77531 · Telegram Post