Cloudanix VulnDB

CVE-2014-9769

High · 7.3

CVSS

7.3

EPSS

2.4%

Published

Mar 28, 2016

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in an older version of a common text-matching library can let attackers send specially crafted data that crashes programs using that library, interrupting services until fixed.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper handling of table jumps during JIT compilation of nested alternatives in pcre_jit_compile.c leads to stack memory corruption when processing a specially crafted input string.

Why it matters to the business

Applications relying on PCRE for regex matching, such as intrusion detection systems or text processors, may experience crashes or unexpected behavior that disrupts service availability and requires emergency restarts or patching.

How an attack unfolds

An attacker crafts a malicious input string containing nested alternatives designed to trigger flawed JIT table handling in PCRE 8.35; when the vulnerable application applies a regex to this input, the JIT compiler corrupts stack memory, resulting in denial of service or potential further impact.

How to fix it

Upgrade PCRE to a version newer than 8.35 that resolves the JIT table-jump handling defect; disable JIT compilation via pcre_jit_stack or compile-time options as a temporary mitigation if immediate upgrade is not feasible.

How to confirm the fix worked

Confirm PCRE version is greater than 8.35, test the application with known triggering regex patterns from the original disclosure, and monitor for absence of stack corruption under load with the same inputs.

Typical attack path

  1. Identify an application that uses PCRE regex matching on untrusted input
  2. Craft a string that exercises nested alternatives in a JIT-compiled pattern
  3. Submit the string via network packet, file, or API call
  4. Trigger the regex evaluation to force JIT compilation and observe corruption

How to detect it

Inspect application and system logs for unexpected crashes or segmentation faults in processes linked against PCRE during regex processing; correlate with Suricata or similar IDS logs showing unusual packet patterns that match Emerging Threats rulesets.

What your security team should do

  • Prioritize upgrade of all PCRE instances to a fixed release
  • Review and replace regex patterns that use complex nested alternatives where possible
  • Enable runtime monitoring for crashes in processes that invoke PCRE JIT
  • Add the CVE to vulnerability scanning policies for legacy systems

The record

pcre_jit_compile.c in PCRE 8.35 does not properly use table jumps to optimize nested alternatives, which allows remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via a crafted string, as demonstrated by packets encountered by Suricata during use of a regular expression in an Emerging Threats Open ruleset.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 pcre3 0 2:8.38-1
Debian:12 pcre3 0 2:8.38-1
Ubuntu:14.04:LTS pcre3 0 1:8.31-2ubuntu2.1
Ubuntu:14.04:LTS pcre3 0 1:8.31-2ubuntu2.2
Ubuntu:16.04:LTS pcre3 0 2:8.38-3.1

Related vulnerabilities