YAML::Syck Use-After-Free and Double-Free Vulnerability in Perl

A use-after-free and double-free vulnerability has been identified in YAML::Syck versions prior to 1.47 for Perl. The issue arises in the bundled libsyck C library when an anchor node is redefined or removed. The functions syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node associated with the anchor name, but that node can still be live on the parser's value stack. This leads to a scenario where the node is freed twice, causing a crash in the interpreter. The vulnerability can be exploited by loading an untrusted document that redefines an anchor mid-parse, resulting in a denial-of-service condition.

Impact

Exploitation of this vulnerability leads to a double-free condition, causing heap corruption and a crash of the Perl interpreter.

Reproduction

The vulnerability can be reproduced by using the YAML::Syck::Load() function with a 7-byte input that redefines an anchor. This input triggers the use-after-free and double-free condition by evicting an anchor node that is still live on the parser's value stack, causing it to be freed a second time when the anchor is redefined.

Remediation

Users can upgrade to YAML::Syck version 1.47 or later, where this vulnerability has been fixed.