Use-after-free in libyang - #VU165956

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.

The vulnerability exists due to use-after-free in libyang's schema compiler when lyplg_type_store_union() frees storage on error and lys_compile_unres_dflt() subsequently dereferences and frees the same storage. A remote attacker can supply a crafted YANG module containing a union typedef with a leafref member and an out-of-range default value, such as "999" for int8, to trigger use-after-free and double-free, crashing the parser or potentially hijacking control flow.

Affected software

Remediation

External References

• https://github.com/CESNET/libyang/security/advisories/GHSA-9j24-j628-8cm4

Related Security Bulletins

• Multiple vulnerabilities in libyang