PT-2021-10981 · Retdec · Retdec

Seviezhou · Published 2021-04-21 · Updated 2021-04-26 · CVE-2020-23907

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: retdec version 3.3

Description: An issue in the canSplitFunctionOn() function of ir modifications.cpp can cause a heap buffer overflow, leading to a possible out of bounds read. The impact of this issue includes Deny of Service, Memory Disclosure, and Possible Code Execution.

Recommendations: For retdec version 3.3, consider applying a patch or fix to address the heap buffer overflow issue in the canSplitFunctionOn() function to prevent potential Deny of Service, Memory Disclosure, and Possible Code Execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-23907

Affected Products

Retdec

References · 5

• 🔥 https://github.com/avast/retdec/issues/637 · Exploit
• https://github.com/avast/retdec/commit/517298bafaaff0a8e3dd60dd055a67c41b545807 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-23907 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23907 · Vendor Advisory
• https://t.me/cvenotify/13746 · Telegram Post