# CVE-2018-6797: A crafted regular expression can cause a heap buffer write overflow in Perl 5 giving a remote attacker control over bytes written

Crafted Perl regex with \xDF chars after a \N{} unicode escape overflows a heap buffer, letting an attacker control bytes written past the allocation.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: geeknik
- Disclosed: 2018-05-19
- CVE: CVE-2018-6797
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/337986
- Library page: https://bugbountylibrary.com/r/h1%3A337986
- Tags: area:oss domain:oss impact:integrity impact:rce kind:bounty platform:hackerone sev:high tech:linux technique:fuzzing vuln:memory-corruption vuln:rce

**Target:** Perl regex compiler (regcomp.c S_regatom)
**Root cause:** When a regex is put into unicode matching mode by an escape like \N{}, each subsequent \xDF character causes S_regatom to write one byte past the allocated buffer, and following regex text is written in order into the overflowed region.
**Steps:**
1. Compile a Perl regex containing a unicode-mode escape such as `\N{}` followed by one or more `\xDF` characters.
2. Each `\xDF` adds one byte of heap overflow; trailing regex text is written sequentially into the overflowed region.
3. Run under AddressSanitizer to observe WRITE of size 1 past the 72-byte region in S_regatom at regcomp.c:13652.
**How found:** Fuzzing/regex testing surfaced an ASan heap-buffer-overflow in S_regatom; reporter traced it to \xDF handling after a unicode-mode escape and reported to the Perl security list.
**Exploitation:** Attacker supplies the malicious regex to a Perl process (e.g. via input compiled into a regex); the overflow writes attacker-chosen bytes past the heap allocation, and depending on heap implementation may yield a nastier exploit with near-complete control over written bytes.
**Insight:** Regex compilers that switch to unicode mode mid-pattern can mis-size buffers for single-byte chars like \xDF; test escape sequences that toggle encoding mode followed by high-byte literals under ASan.