CVE-2020-12723: regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• fedoraproject fedora31
• netapp oncommand workflow automationall versions
• netapp snap creator frameworkall versions
• opensuse leap15.1
• oracle communications billing and revenue management12.0.0.2.0
• oracle communications billing and revenue management12.0.0.3.0
• oracle communications diameter signaling router8.0.0 and later · up to 8.5.0 inclusive
• oracle communications eagle application processor16.1.0 and later · up to 16.4.0 inclusive

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2012-6329The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and…
  49Plan
• CVE-2018-18311Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
  43Plan
• CVE-2018-18312Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
  43Plan

Published before and after this one in the same product

• ← EarlierCVE-2020-10543Jun 5, 2020 · Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer…
  35Monitor
• ← EarlierCVE-2020-10878Jun 5, 2020 · Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation.
  35Monitor
• Later →CVE-2021-36770Aug 11, 2021 · Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in…
  31Monitor

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.