Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.
In the Socket.xs file, the pack_ip_mreq_source() function checks the length of the source argument, but due to a logic error compares it with the byte length stored after the previous multiaddr argument instead of the actual source length. Since both address fields occupy 4 bytes, the correct multiaddr value causes any source length to pass validation. Then source is copied to the 4-byte imr_sourceaddr field using a fixed-size copy. If source has fewer than 4 bytes, the copy operation reads up to 3 bytes beyond the end of the supplied buffer, including data from the adjacent heap memory area in the returned structure.
An attacker can cause disclosure of heap memory fragments of the process (sensitive data leak) and lead to application crash through unstable out-of-bounds read.
Update the Socket module to version 2.041 or newer, available in the CPAN repository (metacpan.org). A patch is also available in the perl5 repository on GitHub (commit de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb).
Socket module for Perl in versions before 2.041.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H