All the vulnerabilites related to rizinorg - rizin
cve-2022-36040
Vulnerability from cvelistv5
Published
2022-09-06 00:00
Modified
2024-08-03 09:51
Severity ?
EPSS score ?
Summary
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from PYC(python) files. A user opening a malicious PYC file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 68948017423a12786704e54227b8b2f918c2fd27 contains a patch.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:51:59.995Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-h897-rhm9-rpmw"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/issues/2963"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/commit/68948017423a12786704e54227b8b2f918c2fd27"
},
{
"name": "GLSA-202209-06",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202209-06"
},
{
"name": "FEDORA-2023-af305bed3d",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "rizin",
"vendor": "rizinorg",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from PYC(python) files. A user opening a malicious PYC file could be affected by this vulnerability, allowing an attacker to execute code on the user\u0027s machine. Commit number 68948017423a12786704e54227b8b2f918c2fd27 contains a patch."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-30T00:00:00",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-h897-rhm9-rpmw"
},
{
"url": "https://github.com/rizinorg/rizin/issues/2963"
},
{
"url": "https://github.com/rizinorg/rizin/commit/68948017423a12786704e54227b8b2f918c2fd27"
},
{
"name": "GLSA-202209-06",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202209-06"
},
{
"name": "FEDORA-2023-af305bed3d",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/"
}
],
"source": {
"advisory": "GHSA-h897-rhm9-rpmw",
"discovery": "UNKNOWN"
},
"title": "Rizin Out-of-bounds Write vulnerability in pyc/marshal.c"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-36040",
"datePublished": "2022-09-06T00:00:00",
"dateReserved": "2022-07-15T00:00:00",
"dateUpdated": "2024-08-03T09:51:59.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-36044
Vulnerability from cvelistv5
Published
2022-09-06 00:00
Modified
2024-08-03 09:52
Severity ?
EPSS score ?
Summary
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from Luac files. A user opening a malicious Luac file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commits 07b43bc8aa1ffebd9b68d60624c9610cf7e460c7 and 05bbd147caccc60162d6fba9baaaf24befa281cd contain fixes for the issue.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:52:00.490Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-mqcj-82c6-gh5q"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/commit/05bbd147caccc60162d6fba9baaaf24befa281cd"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/commit/07b43bc8aa1ffebd9b68d60624c9610cf7e460c7"
},
{
"name": "GLSA-202209-06",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202209-06"
},
{
"name": "FEDORA-2023-af305bed3d",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "rizin",
"vendor": "rizinorg",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from Luac files. A user opening a malicious Luac file could be affected by this vulnerability, allowing an attacker to execute code on the user\u0027s machine. Commits 07b43bc8aa1ffebd9b68d60624c9610cf7e460c7 and 05bbd147caccc60162d6fba9baaaf24befa281cd contain fixes for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-30T00:00:00",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-mqcj-82c6-gh5q"
},
{
"url": "https://github.com/rizinorg/rizin/commit/05bbd147caccc60162d6fba9baaaf24befa281cd"
},
{
"url": "https://github.com/rizinorg/rizin/commit/07b43bc8aa1ffebd9b68d60624c9610cf7e460c7"
},
{
"name": "GLSA-202209-06",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202209-06"
},
{
"name": "FEDORA-2023-af305bed3d",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/"
}
],
"source": {
"advisory": "GHSA-mqcj-82c6-gh5q",
"discovery": "UNKNOWN"
},
"title": "Rizin Out-of-bounds Write vulnerability in Lua binary plugin"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-36044",
"datePublished": "2022-09-06T00:00:00",
"dateReserved": "2022-07-15T00:00:00",
"dateUpdated": "2024-08-03T09:52:00.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-36039
Vulnerability from cvelistv5
Published
2022-09-06 19:05
Modified
2024-08-03 09:52
Severity ?
EPSS score ?
Summary
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to out-of-bounds write when parsing DEX files. A user opening a malicious DEX file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. A patch is available on the `dev` branch of the repository.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/rizinorg/rizin/security/advisories/GHSA-pr85-hv85-45pg | x_refsource_CONFIRM | |
| https://github.com/rizinorg/rizin/issues/2969 | x_refsource_MISC | |
| https://github.com/rizinorg/rizin/commit/1524f85211445e41506f98180f8f69f7bf115406 | x_refsource_MISC | |
| https://security.gentoo.org/glsa/202209-06 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:52:00.495Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-pr85-hv85-45pg"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/issues/2969"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/commit/1524f85211445e41506f98180f8f69f7bf115406"
},
{
"name": "GLSA-202209-06",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202209-06"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "rizin",
"vendor": "rizinorg",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to out-of-bounds write when parsing DEX files. A user opening a malicious DEX file could be affected by this vulnerability, allowing an attacker to execute code on the user\u0027s machine. A patch is available on the `dev` branch of the repository."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-25T15:06:13",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-pr85-hv85-45pg"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rizinorg/rizin/issues/2969"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rizinorg/rizin/commit/1524f85211445e41506f98180f8f69f7bf115406"
},
{
"name": "GLSA-202209-06",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202209-06"
}
],
"source": {
"advisory": "GHSA-pr85-hv85-45pg",
"discovery": "UNKNOWN"
},
"title": "Out-of-bounds write when parsing DEX files in Rizin",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-36039",
"STATE": "PUBLIC",
"TITLE": "Out-of-bounds write when parsing DEX files in Rizin"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "rizin",
"version": {
"version_data": [
{
"version_value": "\u003c= 0.4.0"
}
]
}
}
]
},
"vendor_name": "rizinorg"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to out-of-bounds write when parsing DEX files. A user opening a malicious DEX file could be affected by this vulnerability, allowing an attacker to execute code on the user\u0027s machine. A patch is available on the `dev` branch of the repository."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-787: Out-of-bounds Write"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/rizinorg/rizin/security/advisories/GHSA-pr85-hv85-45pg",
"refsource": "CONFIRM",
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-pr85-hv85-45pg"
},
{
"name": "https://github.com/rizinorg/rizin/issues/2969",
"refsource": "MISC",
"url": "https://github.com/rizinorg/rizin/issues/2969"
},
{
"name": "https://github.com/rizinorg/rizin/commit/1524f85211445e41506f98180f8f69f7bf115406",
"refsource": "MISC",
"url": "https://github.com/rizinorg/rizin/commit/1524f85211445e41506f98180f8f69f7bf115406"
},
{
"name": "GLSA-202209-06",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202209-06"
}
]
},
"source": {
"advisory": "GHSA-pr85-hv85-45pg",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-36039",
"datePublished": "2022-09-06T19:05:11",
"dateReserved": "2022-07-15T00:00:00",
"dateUpdated": "2024-08-03T09:52:00.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-43814
Vulnerability from cvelistv5
Published
2021-12-13 19:35
Modified
2024-08-04 04:03
Severity ?
EPSS score ?
Summary
Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin may crash or execute unintended actions. No workaround are known and users are advised to upgrade.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8r | x_refsource_CONFIRM | |
| https://github.com/rizinorg/rizin/issues/2083 | x_refsource_MISC | |
| https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b5ea406 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:03:09.036Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8r"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/issues/2083"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b5ea406"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "rizin",
"vendor": "rizinorg",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin may crash or execute unintended actions. No workaround are known and users are advised to upgrade."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-13T19:35:12",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8r"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rizinorg/rizin/issues/2083"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b5ea406"
}
],
"source": {
"advisory": "GHSA-hqqp-vjcm-mw8r",
"discovery": "UNKNOWN"
},
"title": "Heap-based OOB write when parsing dwarf DIE info in Rizin",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-43814",
"STATE": "PUBLIC",
"TITLE": "Heap-based OOB write when parsing dwarf DIE info in Rizin"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "rizin",
"version": {
"version_data": [
{
"version_value": "\u003c= 0.3.1"
}
]
}
}
]
},
"vendor_name": "rizinorg"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin may crash or execute unintended actions. No workaround are known and users are advised to upgrade."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-787: Out-of-bounds Write"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8r",
"refsource": "CONFIRM",
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8r"
},
{
"name": "https://github.com/rizinorg/rizin/issues/2083",
"refsource": "MISC",
"url": "https://github.com/rizinorg/rizin/issues/2083"
},
{
"name": "https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b5ea406",
"refsource": "MISC",
"url": "https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b5ea406"
}
]
},
"source": {
"advisory": "GHSA-hqqp-vjcm-mw8r",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-43814",
"datePublished": "2021-12-13T19:35:12",
"dateReserved": "2021-11-16T00:00:00",
"dateUpdated": "2024-08-04T04:03:09.036Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-36041
Vulnerability from cvelistv5
Published
2022-09-06 00:00
Modified
2024-08-03 09:52
Severity ?
EPSS score ?
Summary
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when parsing Mach-O files. A user opening a malicious Mach-O file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 7323e64d68ecccfb0ed3ee480f704384c38676b2 contains a patch.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:52:00.654Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-2c7m-2f37-mr5m"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/issues/2956"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/commit/7323e64d68ecccfb0ed3ee480f704384c38676b2"
},
{
"name": "GLSA-202209-06",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202209-06"
},
{
"name": "FEDORA-2023-af305bed3d",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "rizin",
"vendor": "rizinorg",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when parsing Mach-O files. A user opening a malicious Mach-O file could be affected by this vulnerability, allowing an attacker to execute code on the user\u0027s machine. Commit number 7323e64d68ecccfb0ed3ee480f704384c38676b2 contains a patch."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-30T00:00:00",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-2c7m-2f37-mr5m"
},
{
"url": "https://github.com/rizinorg/rizin/issues/2956"
},
{
"url": "https://github.com/rizinorg/rizin/commit/7323e64d68ecccfb0ed3ee480f704384c38676b2"
},
{
"name": "GLSA-202209-06",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202209-06"
},
{
"name": "FEDORA-2023-af305bed3d",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/"
}
],
"source": {
"advisory": "GHSA-2c7m-2f37-mr5m",
"discovery": "UNKNOWN"
},
"title": "Rizin Out-of-bounds Write vulnerability in Mach-O binary plugin"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-36041",
"datePublished": "2022-09-06T00:00:00",
"dateReserved": "2022-07-15T00:00:00",
"dateUpdated": "2024-08-03T09:52:00.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-36042
Vulnerability from cvelistv5
Published
2022-09-06 00:00
Modified
2024-08-03 09:52
Severity ?
EPSS score ?
Summary
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from dyld cache files. A user opening a malicious dyld cache file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810 contains a patch.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:52:00.511Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-pf72-jg54-8gvp"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/commit/556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810"
},
{
"name": "GLSA-202209-06",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202209-06"
},
{
"name": "FEDORA-2023-af305bed3d",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "rizin",
"vendor": "rizinorg",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from dyld cache files. A user opening a malicious dyld cache file could be affected by this vulnerability, allowing an attacker to execute code on the user\u0027s machine. Commit number 556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810 contains a patch."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-30T00:00:00",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-pf72-jg54-8gvp"
},
{
"url": "https://github.com/rizinorg/rizin/commit/556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810"
},
{
"name": "GLSA-202209-06",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202209-06"
},
{
"name": "FEDORA-2023-af305bed3d",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/"
}
],
"source": {
"advisory": "GHSA-pf72-jg54-8gvp",
"discovery": "UNKNOWN"
},
"title": "Rizin Out-of-bounds Write vulnerability in dyld cache binary plugin"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-36042",
"datePublished": "2022-09-06T00:00:00",
"dateReserved": "2022-07-15T00:00:00",
"dateUpdated": "2024-08-03T09:52:00.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-40022
Vulnerability from cvelistv5
Published
2023-08-24 22:50
Modified
2024-10-02 18:11
Severity ?
EPSS score ?
Summary
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in `consume_count` of `src/gnu_v2/cplus-dem.c`. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block as unreachable code since the prior statement is multiplication by 10 and fails to consider overflow assuming the count will always be a multiple of 10. Rizin version 0.6.1 contains a fix for the issue. A temporary workaround would be disabling C++ demangling using the configuration option `bin.demangle=false`.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq | x_refsource_CONFIRM | |
| https://github.com/rizinorg/rizin/pull/3753 | x_refsource_MISC | |
| https://github.com/rizinorg/rz-libdemangle/pull/54 | x_refsource_MISC | |
| https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018 | x_refsource_MISC | |
| https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:54.616Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq"
},
{
"name": "https://github.com/rizinorg/rizin/pull/3753",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/pull/3753"
},
{
"name": "https://github.com/rizinorg/rz-libdemangle/pull/54",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rizinorg/rz-libdemangle/pull/54"
},
{
"name": "https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018"
},
{
"name": "https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:rizin:rizin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rizin",
"vendor": "rizin",
"versions": [
{
"lessThan": "0.6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40022",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-02T18:05:03.677952Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T18:11:59.833Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rizin",
"vendor": "rizinorg",
"versions": [
{
"status": "affected",
"version": "\u003c 0.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in `consume_count` of `src/gnu_v2/cplus-dem.c`. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block as unreachable code since the prior statement is multiplication by 10 and fails to consider overflow assuming the count will always be a multiple of 10. Rizin version 0.6.1 contains a fix for the issue. A temporary workaround would be disabling C++ demangling using the configuration option `bin.demangle=false`."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-24T22:50:57.457Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq"
},
{
"name": "https://github.com/rizinorg/rizin/pull/3753",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rizinorg/rizin/pull/3753"
},
{
"name": "https://github.com/rizinorg/rz-libdemangle/pull/54",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rizinorg/rz-libdemangle/pull/54"
},
{
"name": "https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018"
},
{
"name": "https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419"
}
],
"source": {
"advisory": "GHSA-92h6-wwc2-53cq",
"discovery": "UNKNOWN"
},
"title": "Rizin vulnerable to Integer Overflow in C++ demangler logic"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-40022",
"datePublished": "2023-08-24T22:50:57.457Z",
"dateReserved": "2023-08-08T13:46:25.243Z",
"dateUpdated": "2024-10-02T18:11:59.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-27590
Vulnerability from cvelistv5
Published
2023-03-14 20:37
Modified
2024-08-02 12:16
Severity ?
EPSS score ?
Summary
Rizin is a UNIX-like reverse engineering framework and command-line toolset. In version 0.5.1 and prior, converting a GDB registers profile file into a Rizin register profile can result in a stack-based buffer overflow when the `name`, `type`, or `groups` fields have longer values than expected. Users opening untrusted GDB registers files (e.g. with the `drpg` or `arpg` commands) are affected by this flaw. Commit d6196703d89c84467b600ba2692534579dc25ed4 contains a patch for this issue. As a workaround, review the GDB register profiles before loading them with `drpg`/`arpg` commands.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:16:35.898Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/rizinorg/rizin/security/advisories/GHSA-rqcp-m8m2-jcqf",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-rqcp-m8m2-jcqf"
},
{
"name": "https://github.com/rizinorg/rizin/pull/3422",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/pull/3422"
},
{
"name": "https://github.com/rizinorg/rizin/commit/d6196703d89c84467b600ba2692534579dc25ed4",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/commit/d6196703d89c84467b600ba2692534579dc25ed4"
},
{
"name": "https://github.com/rizinorg/rizin/blob/3a7d5116244beb678ad9950bb9dd27d28ed2691f/librz/reg/profile.c#L514",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/blob/3a7d5116244beb678ad9950bb9dd27d28ed2691f/librz/reg/profile.c#L514"
},
{
"name": "https://github.com/rizinorg/rizin/blob/3a7d5116244beb678ad9950bb9dd27d28ed2691f/librz/reg/profile.c#L545",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/blob/3a7d5116244beb678ad9950bb9dd27d28ed2691f/librz/reg/profile.c#L545"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WW3JXI4TIJIR7PGFP74SN7GQYHW2F46Y/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "rizin",
"vendor": "rizinorg",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. In version 0.5.1 and prior, converting a GDB registers profile file into a Rizin register profile can result in a stack-based buffer overflow when the `name`, `type`, or `groups` fields have longer values than expected. Users opening untrusted GDB registers files (e.g. with the `drpg` or `arpg` commands) are affected by this flaw. Commit d6196703d89c84467b600ba2692534579dc25ed4 contains a patch for this issue. As a workaround, review the GDB register profiles before loading them with `drpg`/`arpg` commands."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-14T20:37:59.269Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rizinorg/rizin/security/advisories/GHSA-rqcp-m8m2-jcqf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-rqcp-m8m2-jcqf"
},
{
"name": "https://github.com/rizinorg/rizin/pull/3422",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rizinorg/rizin/pull/3422"
},
{
"name": "https://github.com/rizinorg/rizin/commit/d6196703d89c84467b600ba2692534579dc25ed4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rizinorg/rizin/commit/d6196703d89c84467b600ba2692534579dc25ed4"
},
{
"name": "https://github.com/rizinorg/rizin/blob/3a7d5116244beb678ad9950bb9dd27d28ed2691f/librz/reg/profile.c#L514",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rizinorg/rizin/blob/3a7d5116244beb678ad9950bb9dd27d28ed2691f/librz/reg/profile.c#L514"
},
{
"name": "https://github.com/rizinorg/rizin/blob/3a7d5116244beb678ad9950bb9dd27d28ed2691f/librz/reg/profile.c#L545",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rizinorg/rizin/blob/3a7d5116244beb678ad9950bb9dd27d28ed2691f/librz/reg/profile.c#L545"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WW3JXI4TIJIR7PGFP74SN7GQYHW2F46Y/"
}
],
"source": {
"advisory": "GHSA-rqcp-m8m2-jcqf",
"discovery": "UNKNOWN"
},
"title": "Rizin has stack-based buffer overflow when parsing GDB registers profile files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-27590",
"datePublished": "2023-03-14T20:37:59.269Z",
"dateReserved": "2023-03-04T01:03:53.635Z",
"dateUpdated": "2024-08-02T12:16:35.898Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-36043
Vulnerability from cvelistv5
Published
2022-09-06 00:00
Modified
2024-08-03 09:52
Severity ?
EPSS score ?
Summary
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to a double free in bobj.c:rz_bin_reloc_storage_free() when freeing relocations generated from qnx binary plugin. A user opening a malicious qnx binary could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number a3d50c1ea185f3f642f2d8180715f82d98840784 contains a patch for this issue.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:52:00.507Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-rjhv-mj4g-j4p5"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/issues/2964"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rizinorg/rizin/commit/a3d50c1ea185f3f642f2d8180715f82d98840784"
},
{
"name": "GLSA-202209-06",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202209-06"
},
{
"name": "FEDORA-2023-af305bed3d",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "rizin",
"vendor": "rizinorg",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to a double free in bobj.c:rz_bin_reloc_storage_free() when freeing relocations generated from qnx binary plugin. A user opening a malicious qnx binary could be affected by this vulnerability, allowing an attacker to execute code on the user\u0027s machine. Commit number a3d50c1ea185f3f642f2d8180715f82d98840784 contains a patch for this issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415: Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-30T00:00:00",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-rjhv-mj4g-j4p5"
},
{
"url": "https://github.com/rizinorg/rizin/issues/2964"
},
{
"url": "https://github.com/rizinorg/rizin/commit/a3d50c1ea185f3f642f2d8180715f82d98840784"
},
{
"name": "GLSA-202209-06",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202209-06"
},
{
"name": "FEDORA-2023-af305bed3d",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/"
}
],
"source": {
"advisory": "GHSA-rjhv-mj4g-j4p5",
"discovery": "UNKNOWN"
},
"title": "Rizin Double Free in bobj.c when using qnx binary plugin"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-36043",
"datePublished": "2022-09-06T00:00:00",
"dateReserved": "2022-07-15T00:00:00",
"dateUpdated": "2024-08-03T09:52:00.507Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}