UNKNOWN READ Vulnerability in radare2
Summary
OSV-2020-440: UNKNOWN READ in r_uleb128. Affects radare2 versions >= 3f4580b0319ec4a4bcaa2fc8fbd608be948ec054, < 118bf6a693ef0a349959919fd6217e70a26ddf62. Fixed in 118bf6a693ef0a349959919fd6217e70a26ddf62. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
radare2 is an open-source framework for reverse engineering and analyzing binaries. It provides a set of command-line tools and libraries for disassembling, debugging, and analyzing binary files. The vulnerability identified in radare2 is an UNKNOWN READ issue, which can lead to crashes during the execution of the 'r_uleb128' function. This vulnerability was reported through the OSS-Fuzz project.
Vulnerability Detail
The UNKNOWN READ vulnerability in radare2 occurs in the 'r_uleb128' function. When parsing a class, an unknown read operation can be triggered, leading to crashes. The specific crash state is observed in the 'parse_class' and 'dex_loadcode' functions. The impact of this vulnerability can vary depending on the context in which radare2 is used. It could potentially lead to denial of service or information disclosure.
How To Fix
Minimum fixed version
118bf6a693ef0a349959919fd6217e70a26ddf62
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The UNKNOWN READ vulnerability in radare2 can lead to crashes and potentially impact the availability and confidentiality of the system. It is recommended to update radare2 to a version that includes the fix to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for radare2 →
FAQ
radare2 is an open-source framework for reverse engineering and analyzing binaries. It provides a set of command-line tools and libraries for disassembling, debugging, and analyzing binary files.
The impact of this vulnerability can vary depending on the context in which radare2 is used. It could potentially lead to denial of service or information disclosure.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
Yes, a fix for this vulnerability is available in radare2 version '118bf6a693ef0a349959919fd6217e70a26ddf62' and later.
No specific workarounds have been provided for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for radare2.
