Out-of-bounds read in libyang - #VU163172

Vulnerability details

The vulnerability allows an attacker to crash applications that compile attacker-controlled YANG schemas with libyang, causing denial of service.

The vulnerability exists due to an unchecked scan length in ly_strnchr() during schema compilation when a leafref path expression begins with whitespace. An attacker can supply a crafted schema with excessive leading whitespace to control how far the scan reads beyond a heap buffer, potentially reaching unmapped memory and crashing the application.

Affected software

Remediation

External References

• https://github.com/CESNET/libyang/security/advisories/GHSA-gq4m-f2c5-w2mp

Related Security Bulletins

• Multiple vulnerabilities in libyang