CVE-2021-28906
📋 TL;DR
This vulnerability in libyang's read_yin_leaf() function allows a NULL pointer dereference when processing malformed YANG data. It affects systems using libyang v1.0.225 and earlier for network configuration management. Attackers can cause denial of service by crashing applications that parse untrusted YANG files.
💻 Affected Systems
- libyang
- systems using libyang library (e.g., network management tools, NETCONF/YANG implementations)
📦 What is this software?
Libyang by Cesnet
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution if the crash can be leveraged for memory corruption, though this is unlikely given the nature of NULL pointer dereference.
Likely Case
Denial of service through application crash when processing malicious YANG data, disrupting network configuration services.
If Mitigated
Limited impact with proper input validation and sandboxing of YANG parsing processes.
🎯 Exploit Status
Exploitation requires sending malformed YANG data to trigger the NULL pointer dereference. No authentication needed if application accepts external YANG input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libyang v1.0.226 and later
Vendor Advisory: https://github.com/CESNET/libyang/issues/1455
Restart Required: Yes
Instructions:
1. Update libyang to v1.0.226 or later using package manager. 2. Rebuild any applications statically linked to libyang. 3. Restart services using libyang.
🔧 Temporary Workarounds
Input validation
allImplement strict validation of YANG data before passing to libyang functions.
Process isolation
linuxRun YANG parsing in isolated processes/containers to limit crash impact.
🧯 If You Can't Patch
- Restrict YANG data sources to trusted internal systems only.
- Implement monitoring and automatic restart for services using libyang to minimize downtime from crashes.
🔍 How to Verify
Check if Vulnerable:
Check libyang version: 'yanglint --version' or 'ldconfig -p | grep libyang'. If version <= 1.0.225, system is vulnerable.Check Version:
yanglint --version 2>/dev/null || pkg-config --modversion libyang || find /usr -name '*libyang*' -exec strings {} \; 2>/dev/null | grep -i versionVerify Fix Applied:
Confirm libyang version is >= 1.0.226 and test with known malformed YANG data to ensure no crash occurs.📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation fault in libyang functions
- Error logs mentioning read_yin_leaf or YANG parsing failures
Network Indicators:
- Unusual YANG data transfers to network management ports
- Repeated connection attempts to YANG/ NETCONF services
SIEM Query:
source="*libyang*" AND ("segmentation fault" OR "null pointer" OR "read_yin_leaf")