CVE-2024-56406

A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch	Patch
https://metacpan.org/release/SHAY/perl-5.38.4/changes	Release Notes
https://metacpan.org/release/SHAY/perl-5.40.2/changes	Release Notes
http://www.openwall.com/lists/oss-security/2025/04/13/3	Mailing List
http://www.openwall.com/lists/oss-security/2025/04/13/4	Mailing List
http://www.openwall.com/lists/oss-security/2025/04/13/5	Mailing List

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:perl:perl::::::::
	cpe:2.3:a:perl:perl::::::::
	cpe:2.3:a:perl:perl::::::::

History

No history.

Information

Published : 2025-04-13 14:15

Updated : 2025-10-16 14:15

NVD link : CVE-2024-56406

Mitre link : CVE-2024-56406

CVE.ORG link : CVE-2024-56406

JSON object : View

Products Affected

perl

perl

CWE

CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2024-56406", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "published": "2025-04-13T14:15:14.527", "references": [{"url": "https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch", "tags": ["Patch"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/SHAY/perl-5.38.4/changes", "tags": ["Release Notes"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/SHAY/perl-5.40.2/changes", "tags": ["Release Notes"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/13/3", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/13/4", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/13/5", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-787"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A heap buffer overflow vulnerability was discovered in Perl. \n\nRelease branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.\n\nWhen there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.\n\n\u00a0 \u00a0$ perl -e '$_ = \"\\x{FF}\" x 1000000; tr/\\xFF/\\x{100}/;' \n\u00a0 \u00a0Segmentation fault (core dumped)\n\nIt is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad de desbordamiento del b\u00fafer de mont\u00f3n en Perl. Las versiones 5.34, 5.36, 5.38 y 5.40 se ven afectadas, incluyendo las versiones de desarrollo de la 5.33.1 a la 5.41.10. Cuando hay bytes no ASCII en el lado izquierdo del operador `tr`, `S_do_trans_invmap` puede desbordar el puntero de destino `d`. $ perl -e '$_ = \"\\x{FF}\" x 1000000; tr/\\xFF/\\x{100}/;' Fallo de segmentaci\u00f3n (volcado de n\u00facleo). Se cree que esta vulnerabilidad puede permitir ataques de denegaci\u00f3n de servicio y, posiblemente, de ejecuci\u00f3n de c\u00f3digo en plataformas que carecen de defensas suficientes."}], "lastModified": "2025-10-16T14:15:34.083", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F34096A4-1439-4582-8133-8134388418D1", "versionEndExcluding": "5.38.4", "versionStartIncluding": "5.33.1"}, {"criteria": "cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91EF91EF-222F-42C0-A506-0A57B98F1DA5", "versionEndExcluding": "5.40.2", "versionStartIncluding": "5.39.0"}, {"criteria": "cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87807B8D-271E-4B95-ADBC-2383FBD07335", "versionEndIncluding": "5.41.10", "versionStartIncluding": "5.41.0"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}