CVE-2020-24240: Use After Free

August 25, 2020 (updated September 2, 2020)

GNU Bison has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a ‘\0’ byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.

References

lists.gnu.org/r/bug-bison/2020-07/msg00051.html
nvd.nist.gov/vuln/detail/CVE-2020-24240

Code Behaviors & Features

Detect and mitigate CVE-2020-24240 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →