YAML::Syck Out-of-Bounds Read Vulnerability in Base64 Decoder

A vulnerability allowing an out-of-bounds read has been identified in YAML::Syck versions prior to 1.47 for Perl. This issue arises in the base64 decoder of the bundled libsyck, where a signed-char lookup-table index is used to access a 256-entry static table. Any !!binary byte with a value of 0x80 or higher is sign-extended to a negative index, leading to a read before the table. The vulnerability can be triggered by the base64 decoder, which processes the raw bytes of any !!binary node on the default Load path, without the need for special flags. This flaw can be exploited by loading an untrusted document containing a !!binary scalar with a high-bit byte, causing the decoder to read adjacent memory and potentially leak data through the decoded result.

Impact

Exploitation of this vulnerability causes a non-crashing out-of-bounds read, where the read value can leak into the decoded !!binary result, allowing for memory exposure.

Reproduction

The vulnerability can be reproduced by using YAML::Syck::Load() to load a YAML document that includes a !!binary scalar with high-bit bytes, such as 0x80 or above. This can be done by creating a YAML string that represents a binary value with the desired byte values and then loading it with the YAML::Syck module.

Remediation

Users can upgrade to YAML::Syck version 1.47 or later, where this vulnerability has been fixed.