ArchLinux: 202204-4: rizin: multiple issues | LinuxSecurity.com

Advisories

Arch Linux Security Advisory ASA-202204-4
=========================================

Severity: Medium
Date    : 2022-04-04
CVE-ID  : CVE-2021-4022 CVE-2021-43814
Package : rizin
Type    : multiple issues
Remote  : No
Link    : https://security.archlinux.org/AVG-2590

Summary
=======

The package rizin before version 0.3.2-1 is vulnerable to multiple
issues including arbitrary code execution and denial of service.

Resolution
==========

Upgrade to 0.3.2-1.

# pacman -Syu "rizin>=0.3.2-1"

The problems have been fixed upstream in version 0.3.2.

Workaround
==========

None.

Description
===========

- CVE-2021-4022 (denial of service)

A specially crafted binary can make Rizin segfault when it tries to
analyze it (doing a full analysis with aaa). In
rz_core_analysis_type_match retctx structure was initialized on the
stack only after a "goto out_function", where a field of that structure
was freed. When the goto path is taken, the field is not properly
initialized and it could cause a crash of Rizin or have other effects.

- CVE-2021-43814 (arbitrary code execution)

In Rizin versions up to and including 0.3.1 there is a heap-based out
of bounds write in parse_die() when reversing an AMD64 ELF binary with
DWARF debug info. When a malicious AMD64 ELF binary is opened by a
victim user, Rizin may crash or execute unintended actions.

Impact
======

An attacker is able to provide a malicious AMD64 ELF binary that when
opened by a victim may execute arbitrary code on the affected host.

References
==========

https://github.com/rizinorg/rizin/issues/2015
https://github.com/rizinorg/rizin/pull/2031
https://github.com/rizinorg/rizin/commit/21584e416cdcef2fa7d855c5aabf592a965f0e8d
https://github.com/rizinorg/rizin/commit/6ce71d8aa3dafe3cdb52d5d72ae8f4b95916f939
https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8r
https://github.com/rizinorg/rizin/issues/2083
https://github.com/rizinorg/rizin/pull/2086
https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b5ea406
https://github.com/rizinorg/rizin/commit/1a63dad027df62c5d65cad480d9ddc6134a5509b
https://security.archlinux.org/CVE-2021-4022
https://security.archlinux.org/CVE-2021-43814

ArchLinux: 202204-4: rizin: multiple issues

April 5, 2022
The package rizin before version 0.3.2-1 is vulnerable to multiple issues including arbitrary code execution and denial of service

Summary

- CVE-2021-4022 (denial of service)
A specially crafted binary can make Rizin segfault when it tries to analyze it (doing a full analysis with aaa). In rz_core_analysis_type_match retctx structure was initialized on the stack only after a "goto out_function", where a field of that structure was freed. When the goto path is taken, the field is not properly initialized and it could cause a crash of Rizin or have other effects.
- CVE-2021-43814 (arbitrary code execution)
In Rizin versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin may crash or execute unintended actions.

Resolution

Upgrade to 0.3.2-1.
# pacman -Syu "rizin>=0.3.2-1"
The problems have been fixed upstream in version 0.3.2.

References

https://github.com/rizinorg/rizin/issues/2015 https://github.com/rizinorg/rizin/pull/2031 https://github.com/rizinorg/rizin/commit/21584e416cdcef2fa7d855c5aabf592a965f0e8d https://github.com/rizinorg/rizin/commit/6ce71d8aa3dafe3cdb52d5d72ae8f4b95916f939 https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8r https://github.com/rizinorg/rizin/issues/2083 https://github.com/rizinorg/rizin/pull/2086 https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b5ea406 https://github.com/rizinorg/rizin/commit/1a63dad027df62c5d65cad480d9ddc6134a5509b https://security.archlinux.org/CVE-2021-4022 https://security.archlinux.org/CVE-2021-43814

Severity
CVE-ID : CVE-2021-4022 CVE-2021-43814
Package : rizin
Type : multiple issues
Remote : No
Link : https://security.archlinux.org/AVG-2590

Impact

An attacker is able to provide a malicious AMD64 ELF binary that when opened by a victim may execute arbitrary code on the affected host.

Workaround

None.

Related News

© 2022 Guardian Digital, Inc All Rights Reserved

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.