On April 13, 2025, a security vulnerability was reported in certain versions of Perl, designated as CVE-2024-56406. This vulnerability pertains to a heap buffer overflow that occurs when non-ASCII bytes are involved in the tr operator, specifically in Perl versions 5.34, 5.36, 5.38, and 5.40, with a focus on releases from 5.40.0 to 5.40.2, 5.38.0 to 5.38.4, 5.36.0 to 5.36.3, and 5.34.0 to 5.34.3.
The issue arises in the S_do_trans_invmap function, which fails to adequately manage the destination pointer during transliteration. This can lead to severe consequences, as evidenced by a reported case that causes Perl to generate a segmentation fault when a significant number of non-ASCII characters (like \x{FF}) are processed. For instance, executing a simple Perl command to transliterate these characters has resulted in a crash: $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' leads to a core dump. This vulnerability raises concerns regarding potential Denial of Service (DoS) attacks and possibly even unauthorized code execution, particularly on platforms lacking strong security measures.
The nature of the vulnerability aligns with two specific types identified by the Common Weakness Enumeration (CWE): CWE-122, which speaks to heap-based buffer overflows, and CWE-787, referring to out-of-bounds writes.
To mitigate the risk presented by this vulnerability, it is highly recommended that users update their versions of Perl to at least 5.40.2 or 5.38.4. Alternatively, applying the upstream patch available via the referenced links can help alleviate this security risk. Comprehensive patch notes and changes for the updated versions can be found through the following links:
- GitHub commit patch: Patch Details
- MetaCPAN release notes for 5.38.4 and 5.40.2.
The discovery of this vulnerability is credited to Nathan Mills, who reported the issue, prompting a broader discussion on the implications of such weaknesses within open-source software. It underscores the need for developers and users to remain vigilant about updating their systems and applying patches promptly to shield their environments from recurring security threats.
In conclusion, CVE-2024-56406 reveals a significant flaw in certain versions of Perl, with the potential for widespread impacts owing to the nature of buffer overflows and their exploitation. Users of affected versions are urged to act swiftly to maintain their systems’ integrity and security.