CVE-2023-29582: 
NixOS vulnerability analysis and mitigation

CVE-2023-29582 affects yasm version 1.3.0.55.g101bc, where a stack overflow vulnerability was discovered in the parse_expr1 function located in /nasm/nasm-parse.c. This vulnerability has been disputed by third parties who argue it is a bug rather than a security issue, since yasm is a standalone program not designed to run untrusted code (NVD).

The vulnerability manifests as a stack overflow condition in the parse_expr1 function within the NASM parser component. The issue has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local access is required and the primary impact is on availability (NVD).

The vulnerability can lead to a stack overflow condition when processing certain inputs, potentially causing program crashes. However, since yasm is a standalone program not designed to process untrusted input, the real-world security impact is considered limited (Redhat Bugzilla).

A proof of concept exploit has been published demonstrating the stack overflow condition. The vulnerability can be triggered through specially crafted input files that cause recursive function calls in the parser (Github Issue, Exploit POC).

The security community has debated the classification of this issue, with some experts arguing it should be considered a bug rather than a security vulnerability since yasm is not designed to process untrusted input (Redhat Bugzilla).