Vulnerability Details : CVE-2020-24240
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
Vulnerability category: Memory Corruption
Products affected by CVE-2020-24240
- cpe:2.3:a:gnu:bison:3.7:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-24240
0.42%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 59 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-24240
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.1
|
HIGH | AV:N/AC:M/Au:N/C:N/I:N/A:C |
8.6
|
6.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2020-24240
-
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-24240
-
https://github.com/akimd/bison/compare/v3.7...v3.7.1
Comparing v3.7...v3.7.1 · akimd/bison · GitHubThird Party Advisory
-
https://github.com/akimd/bison/commit/be95a4fe2951374676efc9454ffee8638faaf68d
scanner: don't crash on strings containing a NUL byte · akimd/bison@be95a4f · GitHubPatch;Third Party Advisory
-
https://lists.gnu.org/r/bug-bison/2020-07/msg00051.html
[bison 3.7] Bug ReportMailing List;Vendor Advisory
Jump to