PT-2023-21230 · Rizin · Rizin
Yeggor
·
Publicado
2023-03-14
·
Atualizado
2023-07-12
·
CVE-2023-27590
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Rizin versions 0.5.1 and prior
Description
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Converting a GDB registers profile file into a Rizin register profile can result in a stack-based buffer overflow when the
name, type, or groups fields have longer values than expected. Users opening untrusted GDB registers files, for example with the drpg or arpg commands, are affected by this flaw.Recommendations
For Rizin versions 0.5.1 and prior, as a temporary workaround, review the GDB register profiles before loading them with
drpg/arpg commands.
A patch for this issue is available in commit d6196703d89c84467b600ba2692534579dc25ed4.Exploit
Correção
Memory Corruption
Buffer Overflow
Stack Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Rizin