Log in Start free

Vulnerability · Published Mar 3, 2022 · Assigned by GitHub_M

CVE-2022-24724Integer overflow in table parsing extension leads to heap memory corruption

High 8.8

In plain English

A high-severity integer overflow in cmark-gfm from github. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.5% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)4.5%top 8.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8pandoc2.0.6-6.el8_6ALSA-2022:5597
AlmaLinux:8pandoc-common2.0.6-6.el8_6ALSA-2022:5597
Debian:12cmark-gfm0.29.0.gfm.3-3DEBIAN-CVE-2022-24724
Debian:13cmark-gfm0.29.0.gfm.3-3DEBIAN-CVE-2022-24724
Debian:14cmark-gfm0.29.0.gfm.3-3DEBIAN-CVE-2022-24724
Debian:12ghostwriter2.1.6+ds-1DEBIAN-CVE-2022-24724
Debian:13ghostwriter2.1.6+ds-1DEBIAN-CVE-2022-24724
Debian:14ghostwriter2.1.6+ds-1DEBIAN-CVE-2022-24724
Debian:12python-cmarkgfm0.7.0-1DEBIAN-CVE-2022-24724
Debian:13python-cmarkgfm0.7.0-1DEBIAN-CVE-2022-24724
Debian:14python-cmarkgfm0.7.0-1DEBIAN-CVE-2022-24724
Debian:12r-cran-commonmark1.8.0-1DEBIAN-CVE-2022-24724
Debian:13r-cran-commonmark1.8.0-1DEBIAN-CVE-2022-24724
Debian:14r-cran-commonmark1.8.0-1DEBIAN-CVE-2022-24724
Debian:12ruby-commonmarker0.23.4-1DEBIAN-CVE-2022-24724
Debian:13ruby-commonmarker0.23.4-1DEBIAN-CVE-2022-24724
Debian:14ruby-commonmarker0.23.4-1DEBIAN-CVE-2022-24724
Rocky Linux:8pandoc0:2.0.6-6.el8_6RLSA-2022:5597

Affected products (as reported)

VendorProductVersions
github cmark-gfm < 0.28.3.gfm.21>= 0.29.0.gfm.0, < 0.29.0.gfm.3

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References