CVE-2021-28902
📋 TL;DR
This vulnerability in libyang's read_yin_container() function allows a NULL pointer dereference when processing certain YANG data models. It affects systems using libyang v1.0.225 and earlier for network configuration management. Exploitation causes application crashes, potentially disrupting network management operations.
💻 Affected Systems
- libyang
- systems using libyang library
📦 What is this software?
Libyang by Cesnet
⚠️ Risk & Real-World Impact
Worst Case
Denial of service causing network management system failure, potentially disrupting configuration updates and monitoring across managed devices.
Likely Case
Application crash when processing malformed YANG data, requiring service restart and temporary loss of network configuration capabilities.
If Mitigated
Controlled crash with minimal impact if proper monitoring and restart mechanisms are in place.
🎯 Exploit Status
Requires ability to feed malformed YANG data to the vulnerable function, typically through configuration interfaces.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libyang v1.0.226 and later
Vendor Advisory: https://github.com/CESNET/libyang/issues/1454
Restart Required: Yes
Instructions:
1. Update libyang to version 1.0.226 or later. 2. Recompile applications using libyang. 3. Restart affected services.
🔧 Temporary Workarounds
Input validation
allValidate YANG data inputs before processing through libyang functions
🧯 If You Can't Patch
- Restrict access to configuration interfaces that accept YANG data
- Implement monitoring and automatic restart for libyang-based services
🔍 How to Verify
Check if Vulnerable:
Check libyang version: ldd --version | grep libyang or check package managerCheck Version:
pkg-config --modversion libyangVerify Fix Applied:
Verify libyang version >= 1.0.226 and test with known problematic YANG data📡 Detection & Monitoring
Log Indicators:
- Segmentation fault logs from libyang processes
- Unexpected service restarts of network management applications
Network Indicators:
- Unusual YANG data submissions to management interfaces
SIEM Query:
process.name: "*libyang*" AND event.type: "segmentation_fault"