CVE-2021-3518: Use-after-free in libxml2 XInclude recursive processing

libxml2 v2.9.11 contains a use-after-free vulnerability in XInclude processing. When a document recursively includes itself or creates a reference cycle, the document can be freed in a recursive processing context while the parent context still holds a pointer to it. Subsequent use of this freed pointer causes use-after-free vulnerabilities that could lead to information disclosure or code execution.\n\nThe vulnerability occurs in xmlXIncludeLoadDoc when processing recursive includes. After calling xmlXIncludeRecurseDoc (line 1557), which recursively processes the document's includes, the code attempts to use the document pointer at lines 1564-1565, even though the document may have been freed during recursive processing.

Examined xinclude.c in libxml2 v2.9.11. Key observations:\n1. xmlXIncludeLoadDoc (line 1418) loads documents and stores them in ctxt->incTab[nr]->doc\n2. xmlXIncludeRecurseDoc (line 1557) is called to recursively process includes\n3. Inside xmlXIncludeRecurseDoc: (a) copies parent's incTab entries to new context with reference counting (lines 729-733), (b) calls xmlXIncludeDoProcess which may create new incTab entries for the same documents (line 740), (c) after recursion, decrements counts and sets inherited entries to NULL (lines 742-745), (d) calls xmlXIncludeFreeContext which frees all non-NULL entries (line 755)\n4. The vulnerability: new entries created during recursion reference the same document pointer as inherited entries, so the document gets freed when new entries are freed, but parent context still has the pointer\n5. After recursion returns, line 1564-1565 uses the freed document pointer in xmlXIncludeCopyNodeList\n\nThe document deduplication logic at lines 1479-1487 allows multiple incTab entries to reference the same document. Combined with the recursive context handling, this creates the use-after-free condition.",\n"solution_description": "The vulnerability can be fixed by improving the document reference lifecycle management in recursive contexts:\n\n1. Track which incTab entries are newly created during recursion vs inherited from parent\n2. Before freeing the recursive context, NULL out any doc pointers that are still referenced by parent context entries\n3. OR use proper reference counting on document objects themselves, not just incTab entries\n4. OR prevent new entries from being created for documents already in inherited entries\n\nMinimal fix: In xmlXIncludeRecurseDoc, after decrementing counts (lines 742-745), iterate through new entries (indices >= newctxt->incBase) and NULL out doc pointers if they're referenced by parent context, before calling xmlXIncludeFreeContext.", "verification_notes": "The vulnerability affects libxml2 v2.9.11 and can be triggered by:\n1. Creating an XML file that includes itself (e.g., file.xml includes file.xml)\n2. Creating circular include patterns (A includes B, B includes A)\n3. The recursive processing causes the same document to appear in multiple incTab entries\n4. Freed memory in recursive context is used by parent context", "root_cause_type": "use_after_free", "severity": "critical", "error_type": "Use-After-Free", "error_category": "runtime", "lang": "c", "lib_versions": {"libxml2": "v2.9.11"}, "tags": ["use-after-free", "libxml2", "CVE-2021-3518", "XInclude", "recursive-includes", "cold-baseline"] }