CVE-2022-41409

Vulnerability

A vulnerability exists in pcre2test (bundled with PCRE2) prior to version 10.41. When processing a subject line containing a negative repeat value (e.g., {-10}), the code at line 6860 in pcre2test.c miscalculates buffer size due to integer overflow, leading to an infinite loop. The issue is triggered by passing a negative number to the repeat quantifier pattern.

Exploitation

An attacker can cause denial of service by providing a crafted input file to pcre2test that includes a negative repeat value. No special privileges or authentication are required; the attack is performed locally by supplying the malformed input file. The tool enters an infinite loop while resizing the dbuffer, resulting in indefinite hang or resource exhaustion.

Impact

Successful exploitation results in a denial of service (DoS) condition: pcre2test hangs indefinitely, consuming CPU and memory. Although the description mentions "other unspecified impacts", no other consequences are documented in the references. The tool is typically used for testing PCRE2 patterns, so the impact is limited to disruption of testing operations.

Mitigation

The vulnerability is fixed in commit 94e1c001761373b7d9450768aa15d04c25547a35, which was included in PCRE2 version 10.41 and later. The fix adds bounds checking: if (i-- <= 0) and reports "Zero or negative repeat not allowed". Users should upgrade to PCRE2 10.41 or later. No workaround is available. The issue is not listed in CISA's Known Exploited Vulnerabilities (KEV).

[1] [2]