Heap-buffer-overflow in read_uleb128 in radare2
Summary
OSV-2020-881: Heap-buffer-overflow in read_uleb128. Affects radare2 versions >= 74958b8e88879302d6f61a813943b968cf03dbd5, < 3b04d3ef4093dafeff72e22589a3598ca0202ac9. Fixed in 3b04d3ef4093dafeff72e22589a3598ca0202ac9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
radare2 is an open-source framework for reverse engineering and binary analysis. It provides a set of command-line tools and libraries for analyzing and manipulating binary files. The vulnerability in radare2 is related to a heap-buffer-overflow in the read_uleb128 function. This function is responsible for reading unsigned LEB128 values from a binary file. The vulnerability can be triggered when processing a specially crafted binary file, leading to a heap-buffer-overflow read of 1 byte.
Vulnerability Detail
The vulnerability in radare2 can be exploited by an attacker by providing a malicious binary file. When the read_uleb128 function is called to read an unsigned LEB128 value from the file, it fails to properly validate the input, resulting in a heap-buffer-overflow read of 1 byte. This can lead to various consequences, including information disclosure, denial of service, or potential remote code execution.
How To Fix
Minimum fixed version
3b04d3ef4093dafeff72e22589a3598ca0202ac9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in radare2 can be exploited by providing a specially crafted binary file, leading to a heap-buffer-overflow read. To mitigate this vulnerability, it is recommended to update to the latest version of radare2, which includes the fix. No known workaround is available for this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for radare2 →
FAQ
radare2 is an open-source framework for reverse engineering and binary analysis. It provides a set of command-line tools and libraries for analyzing and manipulating binary files.
A heap-buffer-overflow is a type of memory corruption vulnerability where a program reads or writes data outside the bounds of a heap-allocated buffer. In this case, the read_uleb128 function in radare2 reads more data than it should from a buffer, leading to a heap-buffer-overflow read.
The potential consequences of this vulnerability include information disclosure, denial of service, or potential remote code execution. An attacker could exploit this vulnerability to read sensitive information from memory, crash the application, or execute arbitrary code.
No, there is no known workaround for this vulnerability. It is recommended to apply the fix provided by the developers of radare2.
To update radare2 to the latest version, you can obtain the fix from the official GitHub repository of radare2. After updating, recompile and reinstall the package to ensure the fix is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for radare2.
