Process denial of service via recursive regex compilation
Published Feb 12, 2020 · Updated Aug 6, 2024
Denial of service in BSD libc regcomp in Apple macOS through 2011 allows attackers to exhaust memory with crafted regular expressions. The compiler recursively processes deeply nested repetition groups without bounding resource consumption, exhausting the affected process's stack or memory. Reachability requires a program to pass an attacker-controlled pattern to regcomp; successful exploitation interrupts that process without reported data disclosure or modification.
Summary
What happened
Denial of service in BSD libc regcomp in Apple macOS through 2011 allows attackers to exhaust memory with crafted regular expressions. The compiler recursively processes deeply nested repetition groups without bounding resource consumption, exhausting the affected process's stack or memory. Reachability requires a program to pass an attacker-controlled pattern to regcomp; successful exploitation interrupts that process without reported data disclosure or modification.
The record
- CVE
- CVE-2011-3336
- Published
- Feb 12, 2020
- Updated
- Aug 6, 2024
- Vendor
- Apple
- Product
- macOS
- Classifications
- CWE-400, T1499
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Feb 12, 2020CVE publishedPublication date reported by the CVE source.
- Aug 6, 2024Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=through 2011
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
- macOS libc regcomp resource-exhaustion proof of conceptproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo