PT-2023-21230 · Rizin · Rizin
Yeggor
·
Published
2023-03-14
·
Updated
2023-07-12
·
CVE-2023-27590
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Rizin versions 0.5.1 and prior
Description
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Converting a GDB registers profile file into a Rizin register profile can result in a stack-based buffer overflow when the
name, type, or groups fields have longer values than expected. Users opening untrusted GDB registers files, for example with the drpg or arpg commands, are affected by this flaw.Recommendations
For Rizin versions 0.5.1 and prior, as a temporary workaround, review the GDB register profiles before loading them with
drpg/arpg commands.
A patch for this issue is available in commit d6196703d89c84467b600ba2692534579dc25ed4.Exploit
Fix
Memory Corruption
Buffer Overflow
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Rizin