Skip to content

GHSA-c8vq-w3wr-6979 on Cyberus Linux 26.05

Aliases: GHSA-c8vq-w3wr-6979, CVE-2026-88815

Packages: perlPackages.DBI

Status: Plausible

Advisory Information

Summary

DBI 1.653 (current CPAN release) has two reproducible SIGSEGVs reachable from documented public interfaces. Both share the same underlying pattern: reading SvPVX(sv) on an SV that is not guaranteed to be SvPOK, so on IV-only/NV-only scalars a NULL-or-garbage pointer is fed to downstream C code (grok_number and hv_fetch).

Both crash the interpreter (SIGSEGV, exit 139) with 100% reproducibility on released 1.653 built against Perl 5.40.1 on x86_64 Linux, and both remain on current master (9603cbb). Impact class matches prior DBI advisories CVE-2019-20919 and CVE-2026-60082.

Bug 1 — DBI::sql_type_cast($sv, SQL_NUMERIC, ...) on pure numeric SV

Location: DBI.xs sql_type_cast_svpv(), SQL_NUMERIC branch (~line 1961 on master):

case SQL_NUMERIC:
    uv = 0;
    grok_flags = grok_number(SvPVX(sv), SvCUR(sv), &uv);

SvPVX(sv) is read without first forcing SvPOK. On an IV/NV-only SV, this dereferences an unmapped/uninitialised pointer inside grok_number.

Reproducer (100% reliable, exit=139 on 1.653 and master):

perl -MDBI -e 'my $x=42; DBI::sql_type_cast($x, DBI::SQL_NUMERIC(), 0)'

Also crashes on my $x = 3.14 (NV), my $x = 1<<40 (large IV), my $x = -1 (negative IV). Safe on my $x = "42"; $x + 0 (PVIV — has PV cache) and on all other SQL type codes.

Impact: any direct caller of the documented DBI::sql_type_cast API crashes the interpreter on plain integer/float inputs. Also reachable via drivers using sql_type_cast_svpv() through DBIS->sql_type_cast_svpv (DBIXS.h:468) when they pass a value that is still IV/NV.

t/90sql_type_cast.t exercises SQL_NUMERIC only with string literals ("aa", "99"), so a pure-IV input never reached the path.

Suggested fix:

case SQL_NUMERIC: {
    STRLEN len;
    const char *p = SvPV(sv, len);   /* force stringify, handle magic */
    uv = 0;
    grok_flags = grok_number(p, len, &uv);
    ...
}

Updates

2026-09-28 22:43 CEST

Metadata changes:

  • Status for package perlPackages.DBI: “Plausible”

2026-09-28 22:43 CEST

Metadata changes:

  • Status for package perlPackages.DBI: “New”