CVE-2024-53427
Published: 26 February 2025
Description
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).
Security Summary
CVE-2024-53427 is a stack-based buffer overflow and out-of-bounds write vulnerability in the decNumberCopy function within decNumber.c, affecting jq versions through 1.7.1. The flaw occurs because the function does not properly account for NaN values being interpreted as numeric, leading to improper handling during operations.
A local attacker with no privileges required can exploit this vulnerability, though it demands high attack complexity and no user interaction. Exploitation is triggered via the --slurp option with a subtraction filter such as .-. applied to crafted input, like a digit string containing NaN (e.g., "1 NaN123" immediately followed by many more digits). This results in high impacts to confidentiality, integrity, and availability with a changed scope, as reflected in the CVSS v3.1 base score of 8.1 (AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and mapped to CWE-843 (Access of Resource Using Incompatible Type).
The jq security advisory at GHSA-x6c3-qv5r-7q22, along with GitHub issues #3196 and #3296, provide further details on the vulnerability, including a proof-of-concept in a referenced Gist and analysis of the affected source code line in decNumber.c. Practitioners should consult these resources for patch information and mitigation guidance.
Details
- CWE(s)