CVE-2024-56406: Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
A heap buffer overflow vulnerability was discovered in Perl.
Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.
When there are non-ASCII bytes in the left-hand-side of the tr operator, Sdotransinvmap can overflow the destination pointer d.
$ perl -e '$ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
Other sources
A heap buffer overflow vulnerability was discovered in Perl.
When there are non-ASCII bytes in the left-hand-side of the tr operator, Sdotransinvmap can overflow the destination pointer d.
$ perl -e '$ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
— Red Hat
Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/perlto a version that resolves this vulnerability.Fixed in 5.36.2-r1 - Upgrade
Upgrade
alpine/perlto a version that resolves this vulnerability.Fixed in 5.38.3-r1 - Upgrade
Upgrade
alpine/perlto a version that resolves this vulnerability.Fixed in 5.40.1-r1 - Upgrade
Upgrade
debian/perlto a version that resolves this vulnerability.Fixed in 5.36.0-7+deb12u2 - Upgrade
Upgrade
debian/perlto a version that resolves this vulnerability.Fixed in 5.40.1-3 - Upgrade
Upgrade
debian/perlto a version that resolves this vulnerability.Fixed in 5.36.0-7+deb12u3Fixed in 5.36.0-7+deb12u4Fixed in 5.40.1-6+deb13u1Fixed in 5.42.3-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.40.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.38.4
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56406?
CVE-2024-56406 has a high severity due to its potential to cause a heap buffer overflow in Perl.
How do I fix CVE-2024-56406?
To fix CVE-2024-56406, upgrade to Perl version 5.40 or later, or apply the provided patches.
What versions of Perl are affected by CVE-2024-56406?
CVE-2024-56406 affects Perl versions from 5.34 up to and including 5.40.
What kind of vulnerability is CVE-2024-56406?
CVE-2024-56406 is a heap buffer overflow vulnerability that can lead to segmentation faults.
What operation in Perl triggers CVE-2024-56406?
The `tr` operator with non-ASCII bytes on the left-hand side triggers CVE-2024-56406.