Re: CVE request: Digest::SHA double free when using load subroutine

[Mark Shelor <mshelor () cpan org>]

Kurt Seifried <kseifried@...> writes:

> On 01/15/2013 12:37 PM, Florian Weimer wrote:
> > * Kurt Seifried:
> >
> > > I'm not clear, how would an attacker exploit this? They'd need to
> > > be able to specify the file that gets hashed, and the file would
> > > have to be not present and would thus trigger the crash? Are
> > > there any real world examples of an affected application? (web
> > > based?)
> >
> > My hunch is that this is just a bug, not a security issue.
>
> I'll leave it for now, if anyone comes up with a security impact/etc.
> let us know! (I bet this never happens, ah well =).


Digest::SHA is part of the Perl core, so there's a similarity between this case
and CVE-2008-1927: double-free vulnerability in Perl 5.8.8 allowing a DoS
(memory corruption and crash).

Currently I see no way for an attacker to exploit this bug to allow arbitrary
execution of code from user space.  Any vulnerability of that type would appear
to require preexisting vulnerabilities in the Perl/glibc memory allocators.

Regards, Mark (Digest::SHA upstream)