Critical NULL Pointer Dereference in libyang Package
Summary
DEBIAN-CVE-2023-26917: libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse_mem.c. Affects libyang versions < 3.4.2+dfsg-2. Fixed in 3.4.2+dfsg-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libyang is a library for parsing and manipulating YANG data models, widely used in network management and configuration applications. It provides functionalities for validating and processing YANG models, making it essential for developers working with network protocols. However, a vulnerability has been identified that affects versions from v2.0.164 to v2.1.30, potentially compromising the stability of applications relying on this library.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference in the function lysp_stmt_validate_value located in lys_parse_mem.c. This flaw can lead to application crashes or undefined behavior when the affected versions of libyang are used. Attackers could exploit this vulnerability to disrupt services or execute arbitrary code, posing significant risks to systems utilizing the library.
How To Fix
Minimum fixed version
3.4.2+dfsg-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libyangTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to prevent NULL values from being processed by the library. This may involve checking data before passing it to libyang functions, thereby reducing the risk of triggering the vulnerability.
Conclusion
The NULL pointer dereference vulnerability in libyang poses significant risks to applications using this library. It is crucial to update to the patched version to mitigate these risks. For those unable to update immediately, implementing input validation can serve as a temporary measure.
See every vulnerability recorded for libyang →
FAQ
The impact includes potential application crashes and undefined behavior, which can disrupt services and compromise system stability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Versions from v2.0.164 to v2.1.30 of libyang are affected by this vulnerability.
Yes, a patched version 3.4.2+dfsg-2 is available for both Debian 13 and Debian 14.
Implement input validation to prevent NULL values from being processed by libyang functions as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for libyang.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
