Critical NULL Pointer Dereference in libyang Package
Summary
DEBIAN-CVE-2023-26916: libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c. Affects libyang versions < 3.4.2+dfsg-2. Fixed in 3.4.2+dfsg-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libyang is a library for parsing and manipulating YANG data models, widely used in network management and configuration applications. It provides functionalities for data modeling, validation, and conversion, making it essential for developers working with network protocols. However, versions from v2.0.164 to v2.1.30 have been found to contain a vulnerability that could lead to application crashes or unexpected behavior.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2023-26916 is a NULL pointer dereference that occurs in the function lys_parse_mem within the libyang library. This flaw can be exploited by attackers to cause a denial of service (DoS) by crashing the application that relies on this library. The issue arises when the library attempts to parse memory without proper validation, leading to potential instability in applications that utilize libyang.
How To Fix
Minimum fixed version
3.4.2+dfsg-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libyangTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected versions of libyang (v2.0.164 to v2.1.30) until they can apply the patch. It is advisable to review the application code to ensure that it does not invoke the vulnerable function lys_parse_mem with unvalidated input.
Conclusion
The vulnerability in the libyang package poses significant risks to applications that rely on it. By updating to the patched version, users can mitigate these risks and ensure the stability and security of their applications. It is crucial to stay informed about such vulnerabilities and take proactive measures to protect software systems.
See every vulnerability recorded for libyang →
FAQ
A NULL pointer dereference occurs when a program attempts to access memory that has not been allocated, leading to crashes or unpredictable behavior.
Exploiting this vulnerability can lead to application crashes, causing denial of service and potentially exposing sensitive data.
If your application uses libyang versions from v2.0.164 to v2.1.30, it is likely affected. You can check using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, consider implementing a workaround by avoiding the use of the vulnerable function and reviewing your application for potential risks.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-26916.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libyang.
