CVE-2021-28904
📋 TL;DR
This vulnerability in libyang's ext_get_plugin() function allows a NULL pointer dereference when the revision parameter is NULL, causing a crash. It affects systems using libyang v1.0.225 and earlier for YANG data modeling. The crash can lead to denial of service for applications relying on this library.
💻 Affected Systems
- libyang
📦 What is this software?
Libyang by Cesnet
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash leading to denial of service for systems using libyang, potentially affecting network management systems, routers, or other infrastructure components.
Likely Case
Application instability or crashes when processing malformed YANG data with NULL revision values, causing service interruptions.
If Mitigated
Minimal impact if proper input validation is implemented at the application layer or if the vulnerable function isn't called with NULL parameters.
🎯 Exploit Status
Exploitation requires ability to trigger ext_get_plugin() with NULL revision parameter, which depends on application usage patterns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.0.226 and later
Vendor Advisory: https://github.com/CESNET/libyang/issues/1451
Restart Required: Yes
Instructions:
1. Update libyang to v1.0.226 or later. 2. Recompile applications using libyang. 3. Restart affected services.
🔧 Temporary Workarounds
Input validation wrapper
allAdd NULL check before calling ext_get_plugin() in application code
// C code example: if (revision != NULL) ext_get_plugin(...);
🧯 If You Can't Patch
- Implement application-level input validation to prevent NULL revision parameters
- Isolate systems using vulnerable libyang versions from untrusted data sources
🔍 How to Verify
Check if Vulnerable:
Check libyang version: yang --version or check package managerCheck Version:
yang --version 2>/dev/null || dpkg -l | grep libyang || rpm -qa | grep libyangVerify Fix Applied:
Verify version is v1.0.226 or later and test with NULL revision inputs📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Core dumps from libyang processes
- Error logs mentioning ext_get_plugin
Network Indicators:
- Unusual YANG data submissions to network management interfaces
SIEM Query:
process:name="yang" AND event:type="crash" OR error:"segmentation fault"