PCRE up to 10.33 pcre2_jit_compile.c do_extuni_no_utf Pattern memory corruption

Summaryinfo

A vulnerability labeled as problematic has been found in PCRE up to 10.33. Affected by this vulnerability is the function do_extuni_no_utf of the file pcre2_jit_compile.c. The manipulation with the input \X as part of Pattern results in memory corruption. This vulnerability is identified as CVE-2019-20454. The attack is only possible with local access. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in PCRE up to 10.33 (Programming Tool Software). It has been classified as problematic. Affected is the function do_extuni_no_utf of the file pcre2_jit_compile.c. The manipulation with the input value \X leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on availability. CVE summarizes:

An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.

The weakness was released 02/14/2020. This vulnerability is traded as CVE-2019-20454 since 02/14/2020. The exploitability is told to be difficult. The attack needs to be approached locally. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 236606 (Alibaba Cloud Linux 3 : 0050: pcre2 (ALINUX3-SA-2022:0050)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 10.34 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (236606). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Tool Software

Name

• PCRE

Version

• 10.0
• 10.1
• 10.2
• 10.3
• 10.4
• 10.5
• 10.6
• 10.7
• 10.8
• 10.9
• 10.10
• 10.11
• 10.12
• 10.13
• 10.14
• 10.15
• 10.16
• 10.17
• 10.18
• 10.19
• 10.20
• 10.21
• 10.22
• 10.23
• 10.24
• 10.25
• 10.26
• 10.27
• 10.28
• 10.29
• 10.30
• 10.31
• 10.32
• 10.33

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion