PT-2022-12276 · Radare2 · Radare2

0Xshad3 · Published 2022-05-24 · Updated 2022-11-27 · CVE-2021-44975

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions radare2 version 5.5.2

Description The issue is related to a Buffer Overflow in the mach-o parser via /libr/core/anal objc.c.

Recommendations For version 5.5.2, consider disabling the mach-o parser functionality until a patch is available. Restrict access to the /libr/core/anal objc.c module to minimize the risk of exploitation. Avoid using the affected parser in the "anal objc.c" file until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2021-44975

MGASA-2022-0440

Affected Products

Radare2

References · 18

• 🔥 https://github.com/radareorg/radare2/issues/19476 · Exploit
• 🔥 https://census-labs.com/news/2022/05/24/multiple-vulnerabilities-in-radare2 · Exploit
• https://osv.dev/vulnerability/MGASA-2022-0440 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/IQIRJ72UALGMSWH6MYPVJQQLXFGZ23RS · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0440.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-44975 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/JIARALLVVY2362AYFSFULTZKIW6QO5R5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44975 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-44975 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-44975 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/V2UL4V4XKSFJVNNUMFV443UJXGDBYGS4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44975 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44975 · Vendor Advisory
• https://t.me/cibsecurity/43268 · Telegram Post