CVE-2022-24795: Yajl ruby Buffer Overflow Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jj47-x69x-mxrm",
  "modified" : "2022-05-26T18:54:24Z",
  "published" : "2022-04-05T15:55:51Z",
  "aliases" : [ "CVE-2022-24795" ],
  "summary" : "Buffer Overflow in yajl-ruby",
  "details" : "_NOTE: A previous patch, 1.4.2, fixed the heap memory issue, but could still lead to a DoS infinite loop. Please update to version 1.4.3_\n\nThe 1.x branch and the 2.x branch of [yajl](https://github.com/lloyd/yajl) contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs.\n\n### Details\n\nThe [reallocation logic at yajl_buf.c#L64](https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64) may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk.\n\nThese integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer.\n\nSubsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption.\n\n### Impact\n\nWe rate this as a moderate severity vulnerability which mostly impacts process availability as we believe exploitation for arbitrary code execution to be unlikely.\n\n### Patches\n\nPatched in yajl-ruby 1.4.3\n\n### Workarounds\n\nAvoid passing large inputs to YAJL\n\n### References\nhttps://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [yajl-ruby](https://github.com/brianmario/yajl-ruby/issues)\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "yajl-ruby"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.4.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.4.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-24795"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/brianmario/yajl-ruby/commit/7168bd79b888900aa94523301126f968a93eb3a6"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/brianmario/yajl-ruby"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/yajl-ruby/CVE-2022-24795.yml"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/08/msg00003.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KLE3C4CECEJ4EUYI56KXI6OWACWXX7WN"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YO32YDJ74DADC7CMJNLSLBVWN5EXGF5J"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-122", "CWE-190" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-04-05T15:55:51Z",
    "nvd_published_at" : "2022-04-05T16:15:00Z"
  }
}