Use-After-Free Vulnerability in GNU Bison by GNU

CVE-2020-24240

What is CVE-2020-24240?

GNU Bison, prior to version 3.7.1, contains a use-after-free vulnerability in the _obstack_free function within lib/obstack.c. This issue arises when a null byte ('\0') is encountered during processing, which may lead to unsafe behavior if Bison is utilized with untrusted input. While the issue primarily manifests as a crash in Bison itself, the specifics may vary depending on the compiler and architecture used. Mitigating actions should be taken when processing potentially malicious data to avoid exploitation of this vulnerability.

References