CVE-2024-56406: Perl Buffer Overflow Vulnerability

CVE-2024-56406 Overview

CVE-2024-56406 is a heap buffer overflow vulnerability in the Perl interpreter affecting the tr// (transliteration) operator. When non-ASCII bytes appear in the left-hand side of a tr expression, the internal function S_do_trans_invmap can overflow the destination pointer d, corrupting heap memory. The flaw affects Perl release branches 5.34, 5.36, 5.38, and 5.40, along with development versions from 5.33.1 through 5.41.10. Exploitation can trigger denial of service through segmentation faults and may enable arbitrary code execution on platforms lacking hardening protections such as heap canaries or ASLR.

Critical Impact
A local attacker who can influence a Perl script's tr// operand can crash the interpreter and potentially achieve code execution in the context of the Perl process.

Affected Products

Perl 5.34.x release branch
Perl 5.36.x release branch
Perl 5.38.x and 5.40.x release branches (fixed in 5.38.4 and 5.40.2)

Discovery Timeline

2025-04-13 - CVE-2024-56406 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56406

Vulnerability Analysis

The vulnerability resides in S_do_trans_invmap within op.c, the code path that executes the tr/// transliteration operator when its search list is stored as an inversion map. The function calculates a destination buffer size assuming a bounded expansion ratio between input bytes and output bytes. When the left-hand side of the operator contains non-ASCII bytes and the replacement list crosses the 256 codepoint boundary, the actual expansion can exceed the precomputed allocation. Writes past the end of d corrupt adjacent heap metadata. This maps to [CWE-122] Heap-based Buffer Overflow and [CWE-787] Out-of-bounds Write.

Root Cause

The root cause is an incorrect max_expansion value used to size the destination buffer. When a single-byte source codepoint (t_cp < 256) is transliterated to a multi-byte UTF-8 target crossing the 256 boundary (r_cp_end > 255), the interpreter must be prepared to write up to two bytes per input byte. The original code did not force max_expansion to at least 2 in this case, causing under-allocation.

Attack Vector

Exploitation requires local execution of an attacker-influenced Perl script. Any application that passes user-controlled data into a tr// operator with UTF-8 semantics is a candidate delivery path. The following one-liner from the advisory reliably crashes an unpatched interpreter:

perl -e '$_ = "\x{FF}" x 1000000; tr/\\xFF/\x{100}/;'
# Segmentation fault (core dumped)

The patch enforces a minimum expansion factor of 2 when the search and replacement lists straddle the ASCII/non-ASCII boundary:

                 * same time.  But otherwise one crosses before the other */
                if (t_cp < 256 && r_cp_end > 255 && r_cp != t_cp) {
                    can_force_utf8 = TRUE;
+                   max_expansion = MAX(2, max_expansion);
                }
            }

Source: GitHub Perl Commit Patch

Detection Methods for CVE-2024-56406

Indicators of Compromise

Perl interpreter processes terminating with SIGSEGV during tr/// operation on UTF-8 data
Core dumps referencing S_do_trans_invmap or Perl_do_trans in the crashing stack frame
Heap corruption warnings from glibc such as malloc(): corrupted top size originating from perl processes

Detection Strategies

Inventory installed Perl versions across Linux, macOS, and Windows systems and flag any interpreter in the 5.34.x–5.40.x range below the patched releases
Scan repositories and running scripts for tr/// usage combined with UTF-8 codepoints above \x{FF} on the replacement side
Enable ASan or MSan in CI pipelines that run Perl-based test suites to surface the overflow before deployment

Monitoring Recommendations

Alert on unexpected crashes of long-running Perl services such as web applications, log processors, and build systems
Ingest system audit logs and core dump metadata into a central data lake to correlate crashes across hosts
Track process-lineage telemetry from EDR to identify Perl interpreters spawning shells or writing to sensitive paths after abnormal termination

How to Mitigate CVE-2024-56406

Immediate Actions Required

Upgrade Perl to 5.38.4, 5.40.2, or later on all affected systems
Apply distribution vendor patches for packaged Perl builds where upstream upgrades are not immediately feasible
Audit application code and CGI scripts for tr/// operations that process untrusted UTF-8 input

Patch Information

The fix is committed upstream as 87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd and shipped in Perl 5.38.4 and 5.40.2. See the MetaCPAN Perl 5.38.4 Changes and MetaCPAN Perl 5.40.2 Changes for full release notes, and the Openwall OSS-Security disclosure thread for coordinated advisory details.

Workarounds

Sanitize or reject non-ASCII input before passing it to tr/// operations where patching is deferred
Restrict execution of arbitrary Perl scripts from untrusted sources using OS-level allowlisting
Ensure heap hardening features such as ASLR, glibc MALLOC_CHECK_, and non-executable heap remain enabled to reduce exploitability

bash

# Verify installed Perl version and upgrade path
perl -e 'printf "Perl %vd\n", $^V'

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade perl perl-base

# RHEL/Fedora
sudo dnf upgrade perl perl-libs

# From source
curl -O https://www.cpan.org/src/5.0/perl-5.40.2.tar.gz
tar xzf perl-5.40.2.tar.gz && cd perl-5.40.2
./Configure -des -Dprefix=/usr/local && make && sudo make install