PT-2021-6935 · Rizin · Rizin

Octavio Gallando · Published 2021-11-23 · Updated 2022-08-31 · CVE-2021-4022

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions rizin (affected versions not specified)

Description A vulnerability was found in rizin, related to the analysis of ELF64 binaries for the HPPA architecture. When a specially crafted binary is analyzed by rizin, it causes rizin to crash by freeing an uninitialized memory address. The issue is also related to the use of memory after it has been freed, which can be exploited by a remote attacker to cause a denial of service or execute arbitrary code using a specially crafted malicious binary.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Use After Free

Weakness Enumeration

CWE-400

CWE-416

Related Identifiers

BDU:2022-02697

CVE-2021-4022

Affected Products

Rizin

References · 10

• 🔥 https://github.com/rizinorg/rizin/issues/2015 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-4022 · Security Note
• https://bdu.fstec.ru/vul/2022-02697 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4022 · Vendor Advisory
• https://github.com/rizinorg/rizin/pull/2031 · Note
• https://github.com/rizinorg/rizin/commit/21584e416cdcef2fa7d855c5aabf592a965f0e8d · Note
• https://github.com/rizinorg/rizin/commit/6ce71d8aa3dafe3cdb52d5d72ae8f4b95916f939 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2026928 · Note
• https://cybersecurity-help.cz/vdb/SB2022040519 · Note
• https://t.me/cibsecurity/48801 · Telegram Post