CVE-2023-49555

Executive Summary

CVE-2023-49555 is a denial-of-service (DoS) vulnerability in YASM (Yet Another Assembler) version 1.3.0.86.g9def. The flaw resides in the expand_smacro function within the modules/preprocs/nasm/nasm-pp.c component. A remote attacker can trigger a crash by providing a specially crafted input file, leading to a NULL pointer dereference or infinite loop, causing the assembler to hang or terminate unexpectedly. This vulnerability is particularly relevant for environments that process untrusted assembly source files, such as CI/CD pipelines, code review systems, or security analysis tools. No public exploit code or patch is currently available.

Supply Chain & Package Security

YASM is a widely used assembler in the open-source ecosystem, often integrated into build systems and development toolchains. This vulnerability does not directly affect package registries (NPM, PyPI, Go, Ruby) but can impact downstream software that relies on YASM for assembly processing. Organizations should assess their use of YASM in automated workflows and consider sandboxing or input validation.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data. Based on the nature of the vulnerability (DoS via crafted input), a reasonable estimate would be:

• Attack Vector (AV): Network (AV:N) – the attacker can send a crafted file remotely.
• Attack Complexity (AC): Low (AC:L) – no special conditions required.
• Privileges Required (PR): None (PR:N) – no authentication needed.
• User Interaction (UI): Required (UI:R) – the victim must process the file.
• Scope (S): Unchanged (S:U) – the vulnerability affects only the assembler.
• Confidentiality (C): None (C:N) – no data exposure.
• Integrity (I): None (I:N) – no data modification.
• Availability (A): High (A:H) – service disruption.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Estimated Score: 6.5 (Medium)

Deep Dive & Mechanics

The vulnerability is in the expand_smacro function, which is part of the NASM preprocessor in YASM. This function is responsible for expanding single-line macros during preprocessing. When a malformed macro definition or invocation is provided, the function can enter an infinite loop or dereference a NULL pointer, leading to a crash.

Root Cause: The expand_smacro function does not properly validate the state of the macro expansion context. Specifically, it fails to check for recursive or deeply nested macro expansions, allowing an attacker to craft an input that causes uncontrolled recursion or a NULL pointer access.

Trigger: A specially crafted assembly source file containing a self-referential macro or a macro with an invalid token sequence.

Impact: Denial of service – the assembler process hangs or crashes, preventing legitimate use.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code path is in modules/preprocs/nasm/nasm-pp.c in the expand_smacro function. A hypothetical fix would involve adding bounds checking and recursion depth limits.

Vulnerable Code (simplified):

static void expand_smacro(Token *tline) {
    // No recursion depth check
    while (tline) {
        // Process macro expansion
        // ...
        tline = tline->next; // Potential NULL dereference
    }
}

Patched Code (hypothetical):

#define MAX_MACRO_DEPTH 100

static void expand_smacro(Token *tline, int depth) {
    if (depth > MAX_MACRO_DEPTH) {
        // Report error and abort
        return;
    }
    while (tline) {
        // Process macro expansion
        // ...
        expand_smacro(tline->expansion, depth + 1);
        tline = tline->next;
    }
}

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service on a system running YASM by providing a malicious assembly file.

Lab Setup:

1. Install YASM 1.3.0.86.g9def on a test machine (e.g., Ubuntu 20.04).
2. Create a malicious file poc.asm with a self-referential macro:

   %macro crash 1
       %1 crash
   %endmacro
   crash crash
   

3. Run the command: yasm -f elf64 poc.asm

Expected Result: YASM enters an infinite loop or crashes, consuming CPU resources.

Alternative Payload: Use a deeply nested macro:

%macro recurse 1
    %1 %1 %1 %1 %1 %1 %1 %1 %1 %1
%endmacro
recurse recurse

Blue Team

Detection:

• Monitor for YASM processes consuming excessive CPU time.
• Use file integrity monitoring to detect unexpected assembly files.
• Implement input validation to reject files with suspicious macro patterns.

Mitigation:

• Restrict execution of YASM to trusted users only.
• Use a sandboxed environment (e.g., Docker) for processing untrusted files.
• Apply resource limits (ulimit) to prevent CPU exhaustion.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hash depends on crafted file)
  • poc.asm: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Anomalies: YASM process running for an unusually long time or consuming >90% CPU.
• Network Traffic: None – the attack is file-based.
• Log Entries: YASM error messages such as "Segmentation fault" or "Out of memory" in system logs.

Detection Engineering

YARA Rule

rule CVE_2023_49555_YASM_DOS {
    meta:
        description = "Detects malicious assembly files targeting CVE-2023-49555"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-49555"
    strings:
        $macro1 = "%macro" nocase
        $macro2 = "%endmacro" nocase
        $self_ref = /%macro\s+\w+\s+\d+\s*\n.*\1\s*\n%endmacro/s
    condition:
        $macro1 and $macro2 and #self_ref > 0
}

Sigma Rule

title: YASM Denial of Service via Malicious Macro
id: 7a8b3c2d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects YASM crashes due to crafted assembly files (CVE-2023-49555)
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/yasm'
        CommandLine|contains: '.asm'
    condition: selection
falsepositives:
    - Legitimate use of complex macros
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-49555 YASM DoS Attempt"; flow:to_server; content:"%macro"; nocase; content:"%endmacro"; nocase; pcre:"/%macro\s+\w+\s+\d+\s*\n.*\1\s*\n%endmacro/si"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate YASM: Run YASM in a sandboxed environment (e.g., Docker with limited resources).
2. Input Validation: Reject assembly files containing self-referential macros or excessive nesting.
3. Resource Limits: Use ulimit -t 10 to limit CPU time for YASM processes.

Long-Term Fix:

• Monitor the YASM project for a patch. If none is released, consider forking the project and applying the hypothetical fix described above.
• Migrate to an alternative assembler (e.g., NASM) if YASM is not critical.

Workaround:

• Preprocess assembly files with a custom script that detects and blocks malicious macro patterns before passing them to YASM.

Valters IT
Securing Digital Frontiers