Use-after-free vulnerability in libexpat
Summary
CVE-2022-43680: In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. Affects expat across 2 version ranges.
< 2.2.10-r8
< d77291a4824d78e697c5dc2b8024fd65ab31e209
Fixed in 2.2.10-r8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libexpat is a widely used open-source library for parsing XML documents. It provides a set of functions and APIs for handling XML data. The library is used by various applications and frameworks to parse and process XML files. However, a use-after-free vulnerability has been discovered in libexpat versions prior to 2.4.9. This vulnerability can be triggered in out-of-memory situations, leading to a use-after-free condition in the XML_ExternalEntityParserCreate function. This function is responsible for creating a parser for parsing external entities in XML documents.
Vulnerability Detail
The use-after-free vulnerability in libexpat occurs when the library incorrectly destroys a shared DTD (Document Type Definition) in out-of-memory situations. This can result in a situation where the memory previously allocated for the DTD is freed, but still accessed by the program. An attacker can exploit this vulnerability by crafting a malicious XML document that triggers an out-of-memory condition, leading to a use-after-free condition. This could potentially allow the attacker to execute arbitrary code or cause a denial-of-service (DoS) condition on the affected system.
How To Fix
Minimum fixed version
2.2.10-r8
This is the first release that contains the fix.
sudo apk add --upgrade expatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to a fixed version of libexpat as soon as possible.
Conclusion
The use-after-free vulnerability in libexpat can be a serious security issue, potentially allowing an attacker to execute arbitrary code or cause a denial-of-service condition. It is crucial to update to a fixed version of libexpat (version 2.4.9 or later) to mitigate the risk of exploitation. Regularly checking for updates and applying patches for other dependencies or applications that use libexpat is also recommended. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for expat →
FAQ
libexpat is an open-source library for parsing XML documents. It provides functions and APIs for handling XML data.
A use-after-free vulnerability occurs when a program continues to use memory after it has been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
This vulnerability can be exploited by crafting a malicious XML document that triggers an out-of-memory condition in libexpat, leading to a use-after-free condition.
The impact of this vulnerability can vary depending on the context in which libexpat is used. In some cases, it could allow an attacker to execute arbitrary code or cause a denial-of-service condition on the affected system.
To mitigate the risk of exploitation, it is recommended to update to a fixed version of libexpat (version 2.4.9 or later). Regularly checking for updates and applying patches for other dependencies or applications that use libexpat is also advisable.
Related vulnerabilities
Recent vulnerabilities recorded for expat.
