Out-of-Bounds Read Vulnerability in Radare2 by RadareOrg
CVE-2023-47016

7.5HIGH

Key Information:

Vendor

Radare

Status
Radare2
Vendor
CVE Published:
22 November 2023

What is CVE-2023-47016?

Radare2 version 5.8.9 contains a vulnerability that results in an out-of-bounds read in the function r_bin_object_set_items, specifically located in libr/bin/bobj.c. This flaw can trigger crashes at r_read_le32 found within libr/include/r_endian.h, potentially allowing an attacker to exploit this behavior, leading to unstable system operations or unintended behavior of applications utilizing Radare2.

References

https://github.com/radareorg/radare2/issues/22349
https://github.com/radareorg/radare2/commit/40c9f50e127be...
https://gist.github.com/gandalf4a/65705be4f84269cb7cd725a...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.