Integer Overflow in cmark-gfm Table Parsing Extension Leads to Heap Memory Corruption in CommonMarker
Summary
CVE-2022-24724: Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption. Affects commonmarker versions < 0.23.4. Fixed in 0.23.4. How to fix ↓
Also tracked for
- cmark-gfm · Debian:11
The same CVE-2022-24724 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CommonMarker is a RubyGem package used for rendering Github Flavored Markdown (GFM). It utilizes the cmark-gfm library for this purpose. GFM is a variant of Markdown that includes additional features specific to GitHub, such as tables. The table parsing extension in cmark-gfm allows the rendering of tables in GFM. However, a vulnerability has been discovered in the table parsing extension that can lead to heap memory corruption. This vulnerability affects CommonMarker versions prior to v0.23.4.
Vulnerability Detail
The vulnerability in the cmark-gfm table parsing extension is caused by an integer overflow. When parsing tables with marker rows containing more than UINT16_MAX (65535) columns, an integer overflow occurs. This overflow can result in heap memory corruption. The impact of this corruption can range from information leakage to arbitrary code execution. If CommonMarker is used to render remote user-controlled markdown, this vulnerability can potentially lead to remote code execution (RCE).
How To Fix
Minimum fixed version
0.23.4
This is the first release that contains the fix.
gem install commonmarker -v 0.23.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating CommonMarker is not immediately feasible, a workaround is available. The vulnerability specifically affects the table markdown extensions of cmark-gfm. Disabling the use of the table extension will prevent the vulnerability from being triggered. However, this workaround may impact the rendering of tables in GFM.
Conclusion
In conclusion, CommonMarker versions prior to v0.23.4 are vulnerable to an integer overflow in the cmark-gfm table parsing extension. This vulnerability can lead to heap memory corruption and potentially remote code execution (RCE) if CommonMarker is used to render remote user-controlled markdown. It is recommended to update CommonMarker to version v0.23.4 or later to mitigate this vulnerability. Alternatively, disabling the table extension can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for commonmarker →
FAQ
CommonMarker is a RubyGem package used for rendering Github Flavored Markdown (GFM). It provides a simple and efficient way to parse and render markdown content.
cmark-gfm is a library used by CommonMarker to parse and render GFM. It includes extensions specifically designed for GFM, such as table parsing.
The impact of this vulnerability can range from information leakage to arbitrary code execution. If CommonMarker is used to render remote user-controlled markdown, this vulnerability can potentially lead to remote code execution (RCE).
To fix this vulnerability, update CommonMarker to version v0.23.4 or later. This version includes a patch that addresses the integer overflow issue in the cmark-gfm table parsing extension.
Yes, a workaround is available. The vulnerability specifically affects the table markdown extensions of cmark-gfm. Disabling the use of the table extension will prevent the vulnerability from being triggered. However, this workaround may impact the rendering of tables in GFM.
References
Related vulnerabilities
Recent vulnerabilities recorded for commonmarker.
