Use-after-free vulnerability in GNU Bison
Summary
CVE-2020-24240: GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. Affects bison across 2 version ranges.
< 3.7.2-r0
< be95a4fe2951374676efc9454ffee8638faaf68d
Fixed in 3.7.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Bison is a general-purpose parser generator that converts a grammar description into a C program for parsing. It is widely used in various software projects to generate parsers for different programming languages. The package is an essential component for developers working on language processing tasks.
Vulnerability Detail
The use-after-free vulnerability (CVE-2020-24240) in GNU Bison occurs in the _obstack_free function in lib/obstack.c. This vulnerability is triggered when a '\0' byte is encountered during parsing, leading to a use-after-free condition. Although the risk is limited to situations where Bison is used with untrusted input, there is a possibility of unsafe behavior with specific compiler/architecture combinations. The bug report emphasizes that the crash may occur in Bison itself, rather than in the code generated by Bison.
How To Fix
Minimum fixed version
3.7.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade bisonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. However, users can minimize the risk by avoiding the use of Bison with untrusted input. It is crucial to update to the fixed version as soon as possible to eliminate the vulnerability entirely.
Conclusion
The use-after-free vulnerability in GNU Bison poses a risk when parsing untrusted input. It is crucial for users to update to the fixed version (3.7.2-r0 or later) to eliminate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bison →
FAQ
GNU Bison is a parser generator used to convert grammar descriptions into C programs for parsing.
A use-after-free vulnerability occurs when a program continues to use a memory area after it has been freed, leading to potential crashes or arbitrary code execution.
The vulnerability in GNU Bison can result in crashes or potentially unsafe behavior when parsing untrusted input.
While there is no specific workaround, users can minimize the risk by avoiding the use of Bison with untrusted input and updating to the fixed version.
To fix the vulnerability, users should update the Bison package to version 3.7.2-r0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for bison.
