CVE-2024-53427
📋 TL;DR
A stack-based buffer overflow vulnerability in jq's decNumberCopy function allows out-of-bounds writes when processing specially crafted JSON input containing NaN values. This can lead to arbitrary code execution or application crashes. All users of jq versions through 1.7.1 are affected.
💻 Affected Systems
- jq
📦 What is this software?
Jq by Jqlang
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash causing denial of service and potential data corruption.
If Mitigated
Limited impact with proper input validation and sandboxing in place.
🎯 Exploit Status
Proof of concept available in GitHub advisory. Requires specific input format and jq filter patterns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: jq 1.7.2 or later
Vendor Advisory: https://github.com/jqlang/jq/security/advisories/GHSA-x6c3-qv5r-7q22
Restart Required: No
Instructions:
1. Check current version: jq --version
2. Update via package manager: apt/yum/brew update jq
3. Or compile from source: git clone https://github.com/jqlang/jq.git && cd jq && autoreconf -fi && ./configure && make && sudo make install
🔧 Temporary Workarounds
Input validation filter
allFilter out NaN values before processing with vulnerable operations
jq 'select(type != "number" or . == .)' input.json
Avoid --slurp with subtraction
allDo not use --slurp flag with subtraction operations on untrusted input
🧯 If You Can't Patch
- Implement strict input validation to reject JSON containing NaN values
- Run jq in sandboxed/containerized environments with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Test with: echo '1 NaN12345678901234567890' | jq --slurp '.-.' 2>&1 | grep -i 'overflow\|segmentation\|crash'Check Version:
jq --version | grep -E '^jq-1\.[0-6]\.[0-9]+$|^jq-1\.7\.[0-1]$'Verify Fix Applied:
After update, same test should produce normal JSON output without crashes📡 Detection & Monitoring
Log Indicators:
- Segmentation fault logs
- jq process crashes
- Memory violation errors
Network Indicators:
- Unusual JSON payloads containing NaN patterns
- Repeated jq process restarts
SIEM Query:
process_name:"jq" AND (event_type:"crash" OR exit_code:139 OR exit_code:11)🔗 References
- https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92
- https://github.com/jqlang/jq/blob/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297/src/decNumber/decNumber.c#L3375
- https://github.com/jqlang/jq/issues/3196
- https://github.com/jqlang/jq/issues/3296
- https://github.com/jqlang/jq/security/advisories/GHSA-x6c3-qv5r-7q22
