CVE-2018-19974 - In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scr

CVE-2018-19974

Summary

In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can allow attackers to discover addresses in the real stack (not the YARA virtual stack).

References

https://bnbdr.github.io/posts/extracheese/
https://github.com/bnbdr/swisscheese/
https://github.com/VirusTotal/yara/issues/999
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFFXDAMP6GJ337LIOTVF5I4T6QGMN3ZR/

Vulnerable Configurations

cpe:2.3:a:virustotal:yara:3.8.1:*:*:*:*:*:*:*
cpe:2.3:a:virustotal:yara:3.8.1:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 24-08-2020 - 17:37)
Impact:
Exploitability:

CWE

CWE-908

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:N/A:N

refmap via4

confirm	https://github.com/VirusTotal/yara/issues/999
fedora	FEDORA-2019-a00b4760a0
misc	https://bnbdr.github.io/posts/extracheese/ https://github.com/bnbdr/swisscheese/

Last major update

24-08-2020 - 17:37

Published

17-12-2018 - 19:29

Last modified

24-08-2020 - 17:37