PT-2021-15134 · Hex Rays · Ida Pro

Mickey Jin · Published 2021-06-29 · Updated 2021-08-16 · CVE-2021-22545

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BinDiff versions prior to 7

Description An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset, allowing the attacker to control the instruction pointer and execute arbitrary code.

Recommendations For versions prior to 7, upgrade to version 7 to resolve the issue. As a temporary workaround, consider restricting the use of the BinDiff plugin with IdaPro *.i64 files until the upgrade is applied.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2021-22545

Affected Products

Ida Pro

References · 5

• https://zynamics.com/bindiff/manual/index.html#nyyyy7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22545 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22545 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/4079 · Telegram Post
• https://t.me/cvenotify/16805 · Telegram Post