PT-2024-24184 · Rizin · Rizin

Lazymio · Published 2024-12-12 · Updated 2024-12-13 · CVE-2024-31670

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions rizin versions prior to 0.6.3

Description The issue is related to a buffer overflow that can occur via the create cache bins, read cache accel, and rz dyldcache new buf functions in librz/bin/format/mach0/dyldcache.c. This can potentially lead to exploitation. No information is provided about the estimated number of affected devices or real-world incidents.

Recommendations For versions prior to 0.6.3, update to version 0.6.3 or later to resolve the issue. As a temporary workaround, consider disabling the create cache bins, read cache accel, and rz dyldcache new buf functions until a patch is available. Restrict access to the librz/bin/format/mach0/dyldcache.c module to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2024-31670

Affected Products

Rizin

References · 5

• https://github.com/rizinorg/rizin/commit/75bac3088b2ec173e22d4be9d525ceacc987cf02 · Patch
• https://osv.dev/vulnerability/CVE-2024-31670 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31670 · Security Note
• https://twitter.com/CVEnew/status/1867286543502913646 · Twitter Post
• https://t.me/cvedetector/12802 · Telegram Post