PT-2022-23691 · Redex · Redex

Published 2022-11-10 · Updated 2023-07-21 · CVE-2022-36938

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Redex versions prior to commit 3b44c64

Description The issue concerns the DexLoader function get stringidx fromdex() in Redex, which can load an out of bound address when loading the string index table. This could potentially allow remote code execution during the processing of a 3rd party Android APK file.

Recommendations For Redex versions prior to commit 3b44c64, update to a version that includes the fix for the get stringidx fromdex() function to prevent potential remote code execution. As a temporary workaround, consider restricting the processing of 3rd party Android APK files until the issue is resolved.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

CWE-1284

Related Identifiers

CVE-2022-36938

Affected Products

Redex

References · 4

• https://github.com/facebook/redex/commit/3b44c640346b77bfb7ef36e2413688dd460288d2 · Patch
• https://osv.dev/vulnerability/CVE-2022-36938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36938 · Security Note
• https://t.me/cibsecurity/52941 · Telegram Post