Heap-buffer-overflow in r_read_le32 in radare2
Summary
OSV-2020-357: Heap-buffer-overflow in r_read_le32. Affects radare2 versions >= b022c9533482a8f1c9ae825ced5c1a3e251837d9, < 55ec5cc1938fba3c506e87c5314630f1f0736a15. Fixed in 55ec5cc1938fba3c506e87c5314630f1f0736a15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Radare2 is an open-source framework for reverse engineering and analyzing binary files. It provides a set of command-line tools and libraries that allow users to perform various tasks such as disassembling, debugging, and analyzing binary files. The vulnerability in question, identified as OSV-2020-357, is a heap-buffer-overflow vulnerability that affects the r_read_le32 function in radare2.
Vulnerability Detail
The heap-buffer-overflow vulnerability in r_read_le32 can lead to a crash due to a read of more data than is available in the buffer. This vulnerability can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition. The vulnerability was discovered through an OSS-Fuzz report and has a medium severity rating.
How To Fix
Minimum fixed version
55ec5cc1938fba3c506e87c5314630f1f0736a15
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section.
Conclusion
The heap-buffer-overflow vulnerability in r_read_le32 in radare2 can potentially be exploited by attackers to execute arbitrary code or cause a denial-of-service condition. It is crucial to update the radare2 package to a version that includes the fix to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for radare2 →
FAQ
Radare2 is an open-source framework for reverse engineering and analyzing binary files. It provides a set of command-line tools and libraries.
A heap-buffer-overflow vulnerability occurs when a program reads or writes data beyond the bounds of a buffer allocated in the heap. This can lead to crashes, code execution, or other security issues.
This vulnerability was discovered through an OSS-Fuzz report, which is a continuous fuzzing service for open-source software.
This vulnerability has a medium severity rating.
No, there is no known workaround for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for radare2.
