Corrective updates for the Perl interpreter versions 5.40.2 and 5.38.4 have been released, addressing a vulnerability (CVE-2024-56406) that leads to a buffer overflow when transliterating specially formatted non-ASCII characters using the 'tr/.../...' operator. There is a possibility of exploiting this vulnerability to execute arbitrary code in the system. The issue affects stable releases of Perl starting from 2021 and involves the branches Perl 5.34, 5.36, 5.38, and 5.40. You can track the resolution of the vulnerability in distributions on the following pages: Debian, Ubuntu, Fedora, Arch, FreeBSD. Distributions based on RHEL 9, SUSE 15, and openSUSE Leap 15.6 are not affected as they include versions Perl 5.32 and 5.26.
The vulnerability affects programs that use unchecked external data on the left side of the 'tr' operator, where a variable containing data for character substitution is specified (for example, '$external_string =~ tr/a/b/'). In the function S_do_trans_invmap() that handles the operation of the operator, there is an access to memory outside the allocated buffer when processing certain non-ASCII bytes. The overflow occurs because some byte sequences in the input dataset can be converted to UTF-8 sequences, which require two bytes instead of one.
Notably, the vulnerability arose after a change made in 2020 that removed the additional check for sufficient memory allocation on the grounds that the size could be rounded up when calculating. To check for the vulnerability, you can run the following code: perl -e ‘$_ = “\x{FF}” x 1000000; tr/\xFF/\x{100}/;’ Segmentation fault (core dumped)
Source: opennet.ru
