CVE-2022-43680: Libexpat Use-After-Free Vulnerability

CVE-2022-43680 Overview

CVE-2022-43680 is a use-after-free vulnerability discovered in libexpat, a widely-used XML parsing library. The vulnerability exists in versions through 2.4.9 and occurs in the XML_ExternalEntityParserCreate function. When the system encounters out-of-memory conditions during XML parsing, an overeager destruction of a shared DTD (Document Type Definition) object can lead to memory being freed prematurely while still being referenced, resulting in a use-after-free condition.

Critical Impact
Remote attackers can exploit this vulnerability to cause denial of service conditions by triggering application crashes through crafted XML documents that induce memory allocation failures.

Affected Products

libexpat_project libexpat (through version 2.4.9)
Debian Linux 10.0 and 11.0
Fedora 35, 36, and 37
NetApp H300S, H500S, H700S, H410S, H410C (firmware and hardware)
NetApp Active IQ Unified Manager
NetApp OnCommand Workflow Automation
NetApp SolidFire & HCI Management Node
NetApp HCI Compute Node

Discovery Timeline

October 24, 2022 - CVE-2022-43680 published to NVD
May 30, 2025 - Last updated in NVD database

Technical Details for CVE-2022-43680

Vulnerability Analysis

This use-after-free vulnerability stems from improper memory management in libexpat's handling of external entity parsers. When XML_ExternalEntityParserCreate is called to create a parser for processing external entities, it shares DTD data with the parent parser. Under normal conditions, this shared DTD is managed through reference counting to ensure proper lifetime management.

However, when an out-of-memory (OOM) condition occurs during parser creation or operation, the error handling code path triggers premature destruction of the shared DTD. This occurs because the OOM handler attempts to clean up resources aggressively, not accounting for the fact that the DTD is still referenced by other parser instances. Subsequent operations that attempt to access the now-freed DTD memory result in undefined behavior, typically manifesting as application crashes.

The vulnerability is particularly concerning because XML parsing is often performed on untrusted input in web applications, API endpoints, and document processing systems. An attacker who can control XML content processed by a vulnerable application could potentially craft input designed to trigger OOM conditions and exploit this vulnerability.

Root Cause

The root cause of CVE-2022-43680 lies in the overeager destruction of shared DTD objects during out-of-memory error handling in XML_ExternalEntityParserCreate. The libexpat library uses shared DTD structures to optimize memory usage when parsing external entities. When memory allocation fails, the cleanup routine incorrectly frees the shared DTD without verifying whether other parsers still hold references to it. This violates the fundamental principle of reference-counted memory management, where an object should only be freed when its reference count reaches zero.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no privileges or user interaction. An attacker can exploit this vulnerability by:

Crafting a malicious XML document containing external entity declarations
Engineering the XML structure to maximize memory consumption during parsing
Triggering out-of-memory conditions that invoke the vulnerable code path
Causing the application to crash when it attempts to access the freed DTD memory

The exploitation typically results in denial of service through application crashes. While the vulnerability is classified as impacting availability rather than confidentiality or integrity, repeated exploitation could be used to disrupt critical services that depend on XML processing.

Since no verified exploit code is available for this vulnerability, detailed technical analysis should be consulted through the GitHub Issue #649 which documents the original bug report and the GitHub PR #650 which contains the fix implementation.

Detection Methods for CVE-2022-43680

Indicators of Compromise

Unexpected application crashes in processes that perform XML parsing operations
Core dumps or crash logs showing memory access violations in libexpat library functions
Abnormal patterns of memory allocation failures in XML processing components
Increased frequency of out-of-memory events correlated with XML parsing activities

Detection Strategies

Monitor system logs for segmentation faults or memory corruption errors in applications using libexpat
Implement application-level crash monitoring to detect repeated failures in XML parsing routines
Use memory debugging tools like AddressSanitizer (ASan) during testing to identify use-after-free conditions
Deploy intrusion detection rules to identify malformed XML documents with excessive external entity declarations

Monitoring Recommendations

Enable detailed logging for XML parsing operations in production environments
Configure alerting for abnormal application restart patterns that may indicate exploitation attempts
Monitor memory usage patterns in applications that process untrusted XML input
Regularly audit installed libexpat versions across infrastructure using software composition analysis tools

How to Mitigate CVE-2022-43680

Immediate Actions Required

Update libexpat to version 2.5.0 or later, which contains the fix for this vulnerability
Identify all applications and systems using vulnerable versions of libexpat through dependency scanning
Prioritize patching systems that process untrusted XML input from external sources
Consider implementing input validation to limit XML document complexity as a defense-in-depth measure

Patch Information

The libexpat project has addressed this vulnerability in versions released after 2.4.9. The fix ensures proper reference counting for shared DTD objects, preventing premature destruction during out-of-memory conditions. Detailed patch information is available through:

GitHub PR #616 - Initial fix implementation
GitHub PR #650 - Additional fixes and improvements
Debian Security Advisory DSA-5266
NetApp Security Advisory NTAP-20221118-0007
Gentoo GLSA 202210-38

Workarounds

Limit XML document size and complexity to reduce the likelihood of triggering OOM conditions
Implement memory limits for XML parsing processes using operating system resource controls
Consider using alternative XML parsing libraries temporarily if immediate patching is not feasible
Deploy application-level rate limiting to prevent attackers from repeatedly attempting exploitation

bash

# Check installed libexpat version on Debian/Ubuntu
dpkg -l | grep libexpat

# Update libexpat on Debian/Ubuntu
sudo apt update && sudo apt upgrade libexpat1

# Check installed version on RHEL/CentOS/Fedora
rpm -qa | grep expat

# Update on Fedora
sudo dnf update expat