PT-2026-45212 · Unknown · Sereal::Decoder
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Sereal::Decoder versions prior to 5.005
Description
An issue exists where crafted input can lead to a heap out-of-bounds read. In the file Perl/Decoder/srl decoder.c, the functions
srl read object() and srl read hash() process a COPY tag, which is a back-reference that the decoder re-decodes as a fresh tag. If the target byte matches the SHORT BINARY pattern (an inline string with length encoded in the low bits of the tag), the resulting read may not be bounded to precede the COPY tag's offset and can exceed the input buffer. An attacker can control the COPY offset to land inside a previously decoded value, planting a byte that the decoder interprets as a SHORT BINARY tag, allowing the consumption of up to 31 subsequent bytes from the heap as a hash key or class name.Recommendations
Update to version 5.005 or later.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sereal::Decoder