Executive Summary

This vulnerability exists in Socket versions before 2.041 for Perl and involves an out-of-bounds heap read.

Specifically, in the function pack_ip_mreq_source() within Socket.xs, the length check for the source argument is incorrectly performed using the byte length from a preceding multiaddr argument instead of the source argument itself.

Because both addresses occupy a 4-byte field, a valid multiaddr allows a source of any length to pass the check. The source is then copied into a fixed-size 4-byte field (imr_sourceaddr) without proper validation.

If the source is shorter than 4 bytes, the copy operation reads up to 3 bytes beyond the end of the source buffer, causing an out-of-bounds heap read and copying adjacent heap memory into the returned packed structure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the exposure of adjacent heap memory contents when the function pack_ip_mreq_source() is called with a source argument shorter than 4 bytes.

An attacker might exploit this to read sensitive information from memory that should not be accessible, potentially leading to information disclosure.

However, since this is an out-of-bounds read and not a write, it does not directly allow code execution or memory corruption.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to upgrade the Perl Socket module to version 2.041 or later.

Useful 0 Not Useful 0