PT-2025-23903 · Radare2 · Radare2

Rootsec · Publicado 2025-06-05 · Atualizado 2025-06-05 · CVE-2025-5645

Positive Technologies (AI Summary)

CVSS v4.0

2.0

Baixa

Vetor base

AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Radare2 version 5.9.9

Description A problematic vulnerability was found in Radare2, affecting the function r cons pal init in the library /libr/cons/pal.c of the component radiff2. The manipulation of the argument -T leads to memory corruption. Attacking locally is a requirement, and the complexity of an attack is rather high. The exploitability is told to be difficult. The real existence of this vulnerability is still doubted at the moment. The documentation explains that the parameter -T is experimental and "crashy". Further analysis has shown "the race is not a real problem unless you use asan". A new warning has been added.

Recommendations Apply a patch to fix this issue, specifically the patch with the identifier 5705d99cc1f23f36f9a84aab26d1724010b97798. As a temporary workaround, consider avoiding the use of the experimental parameter -T until the issue is resolved. Restrict access to the vulnerable function r cons pal init to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2025-5645

Produtos afetados

Radare2

Referências · 16

• 🔥 https://drive.google.com/file/d/1LVaraZB30lJXtrvp-4bcEJrZYFJb2bfc/view?usp=sharing · Exploit
• https://github.com/radareorg/radare2/commit/5705d99cc1f23f36f9a84aab26d1724010b97798 · Correção
• https://github.com/radareorg/radare2/issues/24234 · Aviso do Fabricante
• https://github.com/radareorg/radare2/issues/24234#issuecomment-2918847551 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1930532667348406546 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1930579571402776723 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2025-5645 · Aviso do Fabricante
• https://vuldb.com/?ctiid.311133 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-5645 · Aviso do Fabricante
• https://vuldb.com/?submit.586922 · Nota
• https://t.me/cvetracker/25491 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2025-5645 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-5645 · Aviso do Fabricante
• https://vuldb.com/?id.311133 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-5645 · Nota de Segurança