Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at
Bug 2060662 (CVE-2022-24724) - CVE-2022-24724 cmark-gfm: possible RCE due to integer overflow
Summary: CVE-2022-24724 cmark-gfm: possible RCE due to integer overflow
Status: NEW
Alias: CVE-2022-24724
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Nobody
QA Contact:
Depends On: 2060663 2060664 2060665 2060666 2060667 2060668 2074997 2074998
TreeView+ depends on / blocked
Reported: 2022-03-03 23:31 UTC by Anten Skrabec
Modified: 2023-07-07 08:34 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:5597 0 None None None 2022-07-18 14:30:19 UTC

Description Anten Skrabec 2022-03-03 23:31:40 UTC
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow in cmark-gfm's table row parsing `table.c:row_from_string` may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution depending on how and where `cmark-gfm` is used. If `cmark-gfm` is used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE) in applications employing affected versions of the `cmark-gfm` library. This vulnerability has been patched in the following cmark-gfm versions 0.29.0.gfm.3 and 0.28.3.gfm.21. A workaround is available. The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling the table extension will prevent this vulnerability from being triggered.

Comment 1 Anten Skrabec 2022-03-03 23:32:56 UTC
Created ghc-cmark-gfm tracking bugs for this issue:

Affects: fedora-34 [bug 2060663]
Affects: fedora-35 [bug 2060665]

Created ghostwriter tracking bugs for this issue:

Affects: fedora-34 [bug 2060664]
Affects: fedora-35 [bug 2060666]

Comment 8 errata-xmlrpc 2022-07-18 14:30:18 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:5597

Note You need to log in before you can comment on or make changes to this bug.