CVE-2015-8853: Input Validation
A vulnerability was found in perl. The regex engine got into an infinite loop because of the malformation. It is trying to back-up over a sequence of UTF-8 continuation bytes. The character just before the sequence should be a start byte. If it's not, there is a malformation which results in "hang" of regexp matching and CPU exhaustion.
External references:
https://rt.perl.org/Public/Bug/Display.html?id=123562
Upstream fix:
http://perl5.git.perl.org/perl.git/commitdiff/22b433eff9a1ffa2454e18405a56650f07b385b5
Other sources
The (1) Sreghop3, (2) Sreghop4, and (3) Sreghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/perlto a version that resolves this vulnerability.Fixed in 5.22.1 - Upgrade
Upgrade
debian/perlto a version that resolves this vulnerability.Fixed in 5.32.1-4+deb11u3Fixed in 5.32.1-4+deb11u5Fixed in 5.36.0-7+deb12u3Fixed in 5.36.0-7+deb12u2Fixed in 5.40.1-6Fixed in 5.40.1-8 - Upgrade
Upgrade
perlto a version that resolves this vulnerability.Fixed in 5.24.0Patch 22b433eff9a1ffa2454e18405a56650f07b385b5 - Compensating control
Mitigate the denial-of-service risk by throttling or rate-limiting requests that include crafted UTF-8 input affecting Perl regexp matching, since the vulnerability can cause an infinite loop/CPU exhaustion when processing malformed UTF-8 continuation-byte sequences like "a\x80".
Event History
Frequently Asked Questions
What is CVE-2015-8853?
CVE-2015-8853 is a vulnerability in Perl before version 5.24.0 that allows context-dependent attackers to cause a denial of service by triggering an infinite loop with crafted UTF-8 data.
Who is affected by CVE-2015-8853?
The vulnerability affects Perl versions before 5.24.0.
What is the severity of CVE-2015-8853?
CVE-2015-8853 has a severity rating of 7.5 (High).
How do I fix CVE-2015-8853 on Ubuntu?
To fix CVE-2015-8853 on Ubuntu, upgrade the 'perl' package to version 5.18.2-2ubuntu1.4 or later.
Where can I find more information about CVE-2015-8853?
You can find more information about CVE-2015-8853 at the following references: 1. CVE-2015-8853 on MITRE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8853 2. OSS Security mailing list post: http://www.openwall.com/lists/oss-security/2016/04/20/5 3. Ubuntu Security Notice: https://ubuntu.com/security/notices/USN-3625-1