Invalid Pointer Release in YARA During Deserialization

Executive Summary

This vulnerability in YARA 4.5.8 involves an invalid pointer release issue during deserialization of compiled .yrc rule files. It occurs due to insufficient validation of external-variable pointers, which can lead to invalid free operations or wild pointer access. An attacker can exploit this by providing a specially crafted .yrc file that causes memory corruption and application crashes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor YARA application crashes when processing .yrc files. Check logs for segmentation faults or invalid free errors in yr_rules_destroy or yr_object_create. Use the command 'yara -C' on suspicious .yrc files to trigger potential crashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause memory corruption, application crashes, or segmentation faults when processing malicious .yrc files. Attackers can manipulate memory operations, leading to potential denial of service or arbitrary code execution depending on the system configuration and YARA usage.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling denial-of-service attacks through application crashes. Memory corruption may lead to data processing interruptions, potentially affecting availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch from pull request #2244 to validate external-variable pointers during .yrc deserialization. Reject malformed files with ERROR_CORRUPT_FILE before unsafe operations. Update YARA to the patched version to prevent crashes from malicious .yrc files.

Useful 0 Not Useful 0