Heap-buffer-overflow in dex_parse_debug_item in radare2
Summary
OSV-2020-1146: Heap-buffer-overflow in dex_parse_debug_item. Affects radare2 versions >= efe53437ff4f34bbb7785a229c8428b449c6069f, < 37fd41dc09b298cd22b35500f5465ce1a3dd461f. Fixed in 37fd41dc09b298cd22b35500f5465ce1a3dd461f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
radare2 is an open-source framework for reverse engineering and analyzing binary files. It provides a set of command-line tools and libraries for disassembling, debugging, and analyzing executables. The package is widely used by security researchers and developers to understand the inner workings of software. However, a vulnerability has been discovered in the dex_parse_debug_item function of radare2, which can lead to a heap-buffer-overflow read. This vulnerability can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition.
Vulnerability Detail
The vulnerability in radare2 arises from a heap-buffer-overflow read in the dex_parse_debug_item function. This function is responsible for parsing the debug information in DEX (Dalvik Executable) files, which are used by the Android operating system. By exploiting this vulnerability, an attacker can read beyond the bounds of a heap buffer, potentially leading to information disclosure or a crash. The vulnerability was discovered through the OSS-Fuzz project, and more details can be found in the provided link. The severity of this vulnerability is considered medium.
How To Fix
Minimum fixed version
37fd41dc09b298cd22b35500f5465ce1a3dd461f
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As this vulnerability has been fixed in a later version of radare2, the recommended approach is to update the package. However, if updating is not immediately feasible, users can mitigate the risk by avoiding the use of untrusted DEX files with radare2. By refraining from opening or analyzing DEX files from untrusted sources, the likelihood of exploitation can be reduced.
Conclusion
The heap-buffer-overflow vulnerability in radare2's dex_parse_debug_item function poses a risk to the security and stability of systems using this package. It is crucial to update radare2 to a version that includes the fix for this vulnerability. Regularly updating radare2 and avoiding the use of untrusted DEX files can help mitigate the risk. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for radare2 →
FAQ
radare2 is an open-source framework for reverse engineering and analyzing binary files. It provides a set of command-line tools and libraries for disassembling, debugging, and analyzing executables.
A heap-buffer-overflow is a type of memory corruption vulnerability where a program reads or writes data beyond the bounds of a heap-allocated buffer. This can lead to crashes, information disclosure, or arbitrary code execution.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software. The project identified a crash caused by a heap-buffer-overflow read in the dex_parse_debug_item function of radare2.
If exploited, this vulnerability can allow an attacker to execute arbitrary code or cause a denial-of-service condition. It may also lead to information disclosure if sensitive data is present in the heap buffer being read beyond its bounds.
You can use Vulert's playground at Vulert Scanner to check if your radare2 installation is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
References
Related vulnerabilities
Recent vulnerabilities recorded for radare2.
