CVE-2022-23308: valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• apple ipadosbefore 15.5
• apple iphone osbefore 15.5
• apple mac os x10.15.0 and later · before 10.15.7
• apple mac os x10.15.7
• apple macos12.0 and later · before 12.4
• apple macos11.6.0 and later · before 11.6.6
• apple tvosbefore 15.5
• apple watchosbefore 8.6
• debian debian linux9.0
• fedoraproject fedora34
• netapp active iq unified managerall versions
• netapp bootstrap osall versions
• netapp clustered data ontapall versions
• netapp clustered data ontap antivirus connectorall versions
• netapp h300e firmwareall versions
• netapp h300s firmwareall versions
• netapp h410c firmwareall versions
• netapp h410s firmwareall versions
• netapp h500e firmwareall versions
• netapp h500s firmwareall versions

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2008-3529Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to
  47Plan
• CVE-2017-7376Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling
  46Plan
• CVE-2022-40303An issue was discovered in libxml2 before 2.10.3.
  42Plan

Published before and after this one in the same product

• ← EarlierCVE-2021-3517May 19, 2021 · There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11.
  39Monitor
• ← EarlierCVE-2021-3541Jul 9, 2021 · A flaw was found in libxml2.
  27Monitor
• Later →CVE-2022-29824May 3, 2022 · In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows.
  27Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.