CVE-2022-24724

published 2022-03-03

CVE-2022-24724: cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow…

Priority P2 59 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	cmark-gfm	< cmark-gfm 0.29.0.gfm.3-3 (bookworm)	cmark-gfm 0.29.0.gfm.3-3 (bookworm)
debian	ghostwriter	< cmark-gfm 0.29.0.gfm.3-3 (bookworm)	cmark-gfm 0.29.0.gfm.3-3 (bookworm)
debian	python-cmarkgfm	< cmark-gfm 0.29.0.gfm.3-3 (bookworm)	cmark-gfm 0.29.0.gfm.3-3 (bookworm)
debian	r-cran-commonmark	< cmark-gfm 0.29.0.gfm.3-3 (bookworm)	cmark-gfm 0.29.0.gfm.3-3 (bookworm)
debian	ruby-commonmarker	< cmark-gfm 0.29.0.gfm.3-3 (bookworm)	cmark-gfm 0.29.0.gfm.3-3 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
github	cmark-gfm	< 0.28.3.gfm.21	0.28.3.gfm.21
github	cmark-gfm	< 0.29.0.gfm.3	0.29.0.gfm.3
github	cmark-gfm	—	—
github	cmark-gfm	>= 0 < 0.29.0.gfm.3-3	0.29.0.gfm.3-3
github	cmark-gfm	>= 0 < 0.29.0.gfm.3-3	0.29.0.gfm.3-3
github	cmark-gfm	>= 0 < 0.29.0.gfm.3-3	0.29.0.gfm.3-3

Detection & IOCs extracted from sources · hover to see the quote

• → The vulnerability is triggered via table row parsing in cmark-gfm; detect exploitation attempts by monitoring for markdown input containing table marker rows with an abnormally large number of columns (exceeding UINT16_MAX / 65535 columns), which triggers the integer overflow in table.c:row_from_string. ↗
• → The vulnerable code path is exclusively within the table markdown extension of cmark-gfm; detection or WAF rules should focus on table syntax (pipe-delimited marker rows) in user-supplied markdown rendered by affected cmark-gfm versions (< 0.29.0.gfm.3 or < 0.28.3.gfm.21). ↗

• · Disabling the cmark-gfm table extension entirely is a viable workaround that fully prevents this vulnerability from being triggered, at the cost of losing table rendering support. ↗
• · Impact severity depends on deployment context: if cmark-gfm renders remote user-controlled markdown, the vulnerability may escalate to Remote Code Execution; otherwise it may be limited to information leak. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

osv 9.8 CRITICAL

vendor_debian 8.8 HIGH

vendor_redhat 8.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-190