Heap-based buffer overflow in re2c - CVE-2020-11958

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the Scanner::fill in parse/scanner.cc via a long lexeme. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2020-11958

External References

• http://www.openwall.com/lists/oss-security/2020/04/21/1
• https://blogs.gentoo.org/ago/2020/04/19/re2c-heap-overflow-in-scannerfill-scanner-cc/
• https://github.com/skvadrik/re2c/commit/c4603ba5ce229db83a2a4fb93e6d4b4e3ec3776a
• https://usn.ubuntu.com/4338-1/
• https://usn.ubuntu.com/4338-2/
• https://www.openwall.com/lists/oss-security/2020/04/19/1

Related Security Bulletins

• Remote code execution in re2c
• Gentoo update for re2c
• Heap-based buffer overflow in re2c (Alpine package)