XML Parser Reset Heap Exhaustion in libexpat

Executive Summary

This is a denial of service vulnerability in libexpat versions 2.7.2 through 2.9.0. The XML_ParserReset function fails to properly adjust tracked heap allocations when resetting the direct byte count. Attackers can exploit this by submitting a large XML document, causing subsequent documents processed by the same reset parser to fail with an XML_ERROR_NO_MEMORY error until the parser is recreated.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of libexpat installed on your system using commands like 'expat-config --version' or 'dpkg -l | grep libexpat'. If the version is between 2.7.2 and 2.9.0, the system is vulnerable. Monitor for XML parsing failures or 'XML_ERROR_NO_MEMORY' errors after processing large XML documents.

Useful 0 Not Useful 0

Impact Analysis

If you use an affected version of libexpat in applications processing XML documents, an attacker could send a large XML file to crash or hang the parser. Services reusing parsers via XML_ParserReset could reject all later requests after receiving one oversized document, leading to service disruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by exhausting memory during XML parsing, which could lead to service disruptions. While not directly violating GDPR or HIPAA, such disruptions may impact availability requirements under these regulations. GDPR requires data availability for data subjects, and HIPAA mandates timely access to protected health information. A DoS condition could hinder compliance by preventing access to critical data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade libexpat to a version beyond 2.9.0 to address the vulnerability. If upgrading is not possible, avoid reusing XML parsers across requests by recreating them for each document. Disable XML parsing for untrusted inputs if feasible.

Useful 0 Not Useful 0