PT-2017-11438 · Netwide+2 · Netwide Assembler+2
Owl337
·
Published
2017-06-29
·
Updated
2020-01-17
·
CVE-2017-10686
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Netwide Assembler (NASM) version 2.14rc0
Description
The issue is related to multiple heap use after free vulnerabilities in the tool nasm. The heap is allocated in the
token() function and freed in the detoken() function, which is called by pp getline(). However, the heap is used again at multiple positions later, potentially causing damage. This can lead to a corrupted double-linked list in detoken(), a double free or corruption in delete Token(), and an out-of-bounds write in detoken(). There is a high possibility that this could lead to a remote code execution attack.Recommendations
For Netwide Assembler (NASM) version 2.14rc0, consider disabling the
token() and detoken() functions as a temporary workaround until a patch is available. Restrict access to the nasm tool to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
RCE
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Netwide Assembler
Suse
Ubuntu