Stack-buffer-overflow in io_memory_read in radare2
Summary
OSV-2023-1227: Stack-buffer-overflow in io_memory_read. Affects radare2 across 2 version ranges.
>= b647b7d367d6f03d18b870cfcde2a015387c375e, < c7e91db654127765a2d2238752ce76a836b55e02
< fc79e134fa1ebafc00849f129d9a5337c725344c
Fixed in c7e91db654127765a2d2238752ce76a836b55e02. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
radare2 is an open-source framework for reverse engineering and analyzing binary files. It provides a set of tools and libraries for disassembling, debugging, and analyzing executables. The io_memory_read function in radare2 is responsible for reading data from memory. However, a stack-buffer-overflow vulnerability has been identified in this function.
Vulnerability Detail
The stack-buffer-overflow vulnerability in io_memory_read can be triggered when writing more data than the buffer can handle. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or crash the application. The vulnerability was discovered through an OSS-Fuzz report and has been assigned a severity rating of HIGH. The affected version of radare2 is b647b7d367d6f03d18b870cfcde2a015387c375e.
How To Fix
Minimum fixed version
c7e91db654127765a2d2238752ce76a836b55e02
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is crucial to update radare2 to the patched version as soon as possible.
Conclusion
In conclusion, a stack-buffer-overflow vulnerability has been identified in the io_memory_read function of radare2. This vulnerability can lead to memory corruption and potential code execution or application crashes. It is highly recommended to update radare2 to the latest version that includes the fix for this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for radare2 →
FAQ
radare2 is an open-source framework for reverse engineering and analyzing binary files. It provides a set of tools and libraries for disassembling, debugging, and analyzing executables.
The stack-buffer-overflow vulnerability in io_memory_read can lead to memory corruption and potentially allow an attacker to execute arbitrary code or crash the application.
The vulnerability was discovered through an OSS-Fuzz report, which is a continuous fuzzing service for open-source software.
This vulnerability has been assigned a severity rating of HIGH.
There is currently no known workaround for this vulnerability. It is crucial to update radare2 to the patched version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for radare2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
