YAML::Syck Use-After-Free Vulnerability in Perl

A use-after-free vulnerability has been identified in YAML::Syck versions prior to 1.47 for Perl. The issue arises in the bundled libsyck C library, where an anchor name allocated by syck_strndup is improperly managed. The anchor name is stored as both a node's anchor and a key in the parser's anchors table. When the node is freed, the shared key is also released, leading to a dangling pointer. This vulnerability can be exploited by loading an untrusted YAML document that redefines an anchor, causing a read of freed memory.

Impact

Exploitation of this vulnerability leads to a use-after-free condition, where freed memory is accessed, potentially allowing for arbitrary code execution or causing a program crash.

Reproduction

The vulnerability can be reproduced by using the YAML::Syck::Load() function to load a YAML document that redefines an anchor. This can be done by creating a document that includes an anchor reference followed by a redefinition of that anchor. The default YAML::Syck loading behavior will process the document in a way that triggers the use-after-free condition.

Remediation

Users should upgrade to YAML::Syck version 1.47 or later, where this vulnerability has been fixed.