PCRE2 JIT Fallback Out-of-Bounds Read in PCRE2

Executive Summary

PCRE2 before 10.48 has an out-of-bounds read in the pcre2_match function when JIT matching falls back to the interpreter due to invalid UTF data. This happens under specific conditions like using UTF matching with lookbehind and a non-zero starting offset. The vulnerability causes a process crash by reading outside the subject buffer.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed PCRE2 version using 'pcre2-config --version' or 'ldconfig -p | grep pcre2'. If the version is between 10.34 and 10.47, the system is vulnerable. Additionally, monitor for crashes in applications using PCRE2, especially those processing UTF-8 data with lookbehind patterns and JIT enabled.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial of service by crashing the process handling the PCRE2 library. An attacker could exploit it by providing invalid UTF-8 data, causing the application to terminate unexpectedly.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes a denial of service by crashing processes due to out-of-bounds reads. It does not directly expose or leak data, which is a key concern for GDPR or HIPAA compliance. However, persistent crashes could disrupt services handling sensitive data, potentially impacting availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade PCRE2 to version 10.48 or later. If upgrading is not possible, disable JIT for affected PCRE2 calls or validate subject data as UTF-8 before processing. Ensure all patterns are compiled for all JIT matching modes to avoid fallback issues.

Useful 0 Not Useful 0