Exploit
CVE-2024-35328

Improper Control of Resource Identifiers ('Resource Injection') (CWE-99)

Published: Jun 13, 2024 / Updated: 5mo ago

010
CVSS 7.5EPSS 0.04%High
CVE info copied to clipboard

Summary

libyaml v0.2.5 is vulnerable to a denial of service (DoS) attack. The vulnerability exists in the yaml_parser_parse function of the /src/libyaml/src/parser.c file. An attacker can send specially crafted input that causes excessive resource consumption, leading to a DoS condition.

Impact

A successful exploitation of this vulnerability could lead to a denial of service, causing the affected system or service to become unresponsive or crash. This could result in system downtime and disruption of operations. The vulnerability has a CVSS v3.1 base score of 7.5 (High severity), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. This indicates that the attack vector is network-based, has low attack complexity, requires no privileges or user interaction, and primarily affects the availability of the system.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

Yes, a patch is available. The vulnerability details include a link to a Bugzilla entry from Red Hat with patch information. The patch was added on 2024-06-13.

Mitigation

Apply the available patches from the respective vendors as soon as possible. If patching is not immediately possible, implement workarounds or mitigations recommended by the vendors, such as input validation or resource limits, to reduce the risk of exploitation. Given the high severity score and the potential for system disruption, prioritize this vulnerability for patching efforts, especially for systems exposed to untrusted network traffic.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-35328

Jun 13, 2024 at 4:15 PM
First Article

Feedly found the first article mentioning CVE-2024-35328. See article

Jun 13, 2024 at 4:24 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Jun 13, 2024 at 4:24 PM
Vendor Advisory

RedHat CVE advisory released a security advisory (CVE-2024-35328).

Jun 14, 2024 at 5:15 AM
CVSS

A CVSS base score of 6.5 has been assigned.

Jun 14, 2024 at 5:15 AM / redhat-cve-advisories
Trending

This CVE started to trend in security discussions

Jun 14, 2024 at 6:40 AM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9%)

Jun 14, 2024 at 10:05 AM
Trending

This CVE stopped trending in security discussions

Jun 14, 2024 at 3:40 PM
CVSS

A CVSS base score of 7.5 has been assigned.

Jul 19, 2024 at 3:30 PM / nvd
Static CVE Timeline Graph

Affected Systems

Pyyaml/libyaml
+null more

Exploits

https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35328.c
+null more

Patches

bugzilla.redhat.com
+null more

Attack Patterns

CAPEC-10: Buffer Overflow via Environment Variables
+null more

Vendor Advisory

CVE-2024-35328
Red Hat Enterprise Linux 6 - libyaml - Under investigation Red Hat Enterprise Linux 8 - perl-YAML-LibYAML - Under investigation

News

Update Wed Aug 28 22:31:38 UTC 2024
Update Wed Aug 28 22:31:38 UTC 2024
OE-core CVE metrics for kirkstone on Sun 18 Aug 2024 02:00:01 AM HST
Branch: kirkstone New this week: 2 CVEs CVE-2024-7264 (CVSS3: 6.5 MEDIUM): curl:curl-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7264 * CVE-2024-7272 (CVSS3: 8.8 HIGH): ffmpeg https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7272 * Removed this week: 3 CVEs CVE-2024-29506 (CVSS3: 8.8 HIGH): ghostscript:ghostscript-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-29506 * CVE-2024-29509 (CVSS3:
OE-core CVE metrics for scarthgap on Sun 11 Aug 2024 03:00:01 AM HST
Branch: scarthgap New this week: 33 CVEs CVE-2024-35326 (CVSS3: 9.8 CRITICAL): libyaml:libyaml-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35326 * CVE-2024-40951 (CVSS3: 5.5 MEDIUM): linux-yocto https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-40951 * CVE-2024-41037 (CVSS3: 5.5 MEDIUM): linux-yocto https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-41037 * CVE-2024-41038 (CVSS3: 5.5 MEDIUM):
OE-core CVE metrics for kirkstone on Sun 11 Aug 2024 02:00:01 AM HST
Branch: kirkstone New this week: 3 CVEs CVE-2024-35326 (CVSS3: 9.8 CRITICAL): libyaml:libyaml-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35326 * CVE-2024-41957 (CVSS3: 5.3 MEDIUM): vim https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-41957 * CVE-2024-41965 (CVSS3: 4.2 MEDIUM): vim https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-41965 * Removed this week: 1 CVEs CVE-2024-24789 (CVSS3:
OE-core CVE metrics for scarthgap on Sun 04 Aug 2024 03:00:01 AM HST
Branch: scarthgap New this week: 33 CVEs CVE-2024-42064 (CVSS3: 5.5 MEDIUM): linux-yocto https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-42064 * CVE-2024-42065 (CVSS3: 5.5 MEDIUM): linux-yocto https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-42065 * CVE-2024-42066 (CVSS3: 5.5 MEDIUM): linux-yocto https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-42066 * CVE-2024-42067 (CVSS3: 5.5 MEDIUM):
See 18 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:None
Integrity:None
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI