CVE-2020-12723: Perl Buffer Overflow Vulnerability

CVE-2020-12723 Overview

CVE-2020-12723 is a buffer overflow vulnerability in regcomp.c in Perl before version 5.30.3 that allows a denial of service condition via crafted regular expressions. The vulnerability occurs due to recursive S_study_chunk calls during regular expression compilation, which can be triggered by specially crafted regex patterns. This flaw enables remote attackers to cause application crashes and service disruption on systems processing untrusted regular expression input.

Critical Impact

Remote attackers can cause denial of service through crafted regular expressions, impacting applications that process user-supplied regex patterns without proper validation.

Affected Products

• Perl versions before 5.30.3
• NetApp OnCommand Workflow Automation
• NetApp Snap Creator Framework
• Fedora 31
• openSUSE Leap 15.1
• Oracle Communications Billing and Revenue Management 12.0.0.2.0, 12.0.0.3.0
• Oracle Communications Diameter Signaling Router
• Oracle Communications Eagle Application Processor
• Oracle Communications Eagle LNP Application Processor 10.1, 10.2
• Oracle Communications LSMS
• Oracle Communications Offline Mediation Controller 12.0.0.3.0
• Oracle Communications Performance Intelligence Center
• Oracle Configuration Manager 12.1.2.0.8
• Oracle Enterprise Manager Base Platform 13.4.0.0
• Oracle SD-WAN Edge 8.2, 9.0, 9.1
• Oracle Tekelec Platform Distribution

Discovery Timeline

• 2020-06-05 - CVE-2020-12723 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-12723

Vulnerability Analysis

This buffer overflow vulnerability exists in the regular expression compilation component of Perl, specifically within the regcomp.c file. The vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input), which represents classic buffer overflow conditions where data is copied to a buffer without adequate size verification.

The flaw manifests during the compilation phase of regular expressions when the S_study_chunk function processes complex regex patterns. Due to the recursive nature of this function, certain crafted regular expressions can trigger excessive recursion leading to a buffer overflow condition. This can result in memory corruption and ultimately cause the Perl interpreter to crash, creating a denial of service condition.

The vulnerability is particularly concerning for applications that accept and compile regular expressions from untrusted sources, such as web applications with user-supplied search patterns, log analysis tools, or content filtering systems.

Root Cause

The root cause lies in the S_study_chunk function within regcomp.c, which performs analysis and optimization of compiled regular expressions. When processing GOSUB regex elements (recursive subpattern calls), the function could mutate the regexp program during the study phase, leading to buffer boundary violations. The fix introduces a was_mutate_ok flag to prevent program mutation during GOSUB processing, ensuring that recursive calls maintain proper bounds checking.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication or user interaction. An attacker can exploit this vulnerability by:

1. Submitting a specially crafted regular expression to an application that compiles user-supplied patterns
2. The malicious regex triggers excessive recursive S_study_chunk calls during compilation
3. The recursion causes buffer overflow, corrupting memory and crashing the Perl interpreter
4. Applications processing the regex become unavailable, resulting in denial of service

The vulnerability affects any Perl application that processes untrusted regular expressions, including web servers, CGI scripts, and command-line tools.

// Security patch in embed.h - study_chunk: avoid mutating regexp program within GOSUB
// Source: https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a

#define ssc_is_cp_posixl_init	S_ssc_is_cp_posixl_init
#define ssc_or(a,b,c)		S_ssc_or(aTHX_ a,b,c)
#define ssc_union(a,b,c)	S_ssc_union(aTHX_ a,b,c)
-#define study_chunk(a,b,c,d,e,f,g,h,i,j,k)	S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k)
+#define study_chunk(a,b,c,d,e,f,g,h,i,j,k,l)	S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k,l)
#  endif
#  if defined(PERL_IN_REGCOMP_C) || defined (PERL_IN_DUMP_C)
#define _invlist_dump(a,b,c,d)	Perl__invlist_dump(aTHX_ a,b,c,d)

Source: GitHub Perl Commit 66bbb51

Detection Methods for CVE-2020-12723

Indicators of Compromise

• Unexpected Perl interpreter crashes or segmentation faults during regex operations
• Application crashes when processing complex or deeply nested regular expressions
• High CPU usage followed by process termination in Perl-based services
• Error logs showing memory corruption or buffer overflow related messages from Perl

Detection Strategies

• Monitor Perl process stability and crash frequency, particularly in applications processing user-supplied regex patterns
• Implement logging around regex compilation operations to identify potentially malicious patterns
• Deploy runtime application self-protection (RASP) to detect buffer overflow attempts in Perl processes
• Use static code analysis tools to identify applications passing untrusted input to regex compilation functions

Monitoring Recommendations

• Configure system monitoring to alert on Perl process crashes or abnormal terminations
• Implement rate limiting on endpoints that accept and process regular expressions
• Review application logs for patterns indicating regex-based attack attempts
• Monitor memory usage anomalies in Perl-based applications that may indicate exploitation attempts

How to Mitigate CVE-2020-12723

Immediate Actions Required

• Upgrade Perl to version 5.30.3 or later on all affected systems
• Apply vendor-specific patches for Oracle, NetApp, and other affected enterprise products
• Implement input validation to restrict or sanitize user-supplied regular expressions
• Consider deploying web application firewalls (WAF) to filter suspicious regex patterns

Patch Information

The vulnerability is fixed in Perl version 5.30.3 and later. The patch modifies the S_study_chunk function to include a was_mutate_ok parameter that prevents program mutation during GOSUB processing. Organizations should update to the patched version using their package manager or by compiling from source.

For detailed patch information, refer to:

• GitHub Perl 5.30.2 to 5.30.3 Comparison
• GitHub Perl Commit 66bbb51

Enterprise vendors have released patches through their respective security advisories, including multiple Oracle Critical Patch Updates from October 2020 through April 2022.

Workarounds

• Avoid compiling regular expressions from untrusted user input until patches can be applied
• Implement regex complexity limits to reject patterns that exceed safe recursion depths
• Use regex sandboxing or timeouts to prevent resource exhaustion from malicious patterns
• Consider using alternative regex engines with better bounds checking for untrusted input scenarios

# Configuration example - Update Perl on Fedora/RHEL-based systems
sudo dnf update perl

# For Debian/Ubuntu-based systems
sudo apt-get update && sudo apt-get upgrade perl

# Verify Perl version after update (should be 5.30.3 or later)
perl -v | grep version