Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields.
The vulnerability is a buffer overflow error during processing of input data passed in the name, type, or group fields. An attacker can provide specially crafted data to these fields, causing memory areas beyond the intended buffer to be overwritten. This results in the possibility of hijacking program execution flow and running malicious code.
An attacker can execute arbitrary code on the vulnerable system (RCE), which potentially leads to complete takeover of the machine, violation of confidentiality, integrity, and availability of data and services.
Patches available from the vendor should be applied according to references — fixes were introduced in pull requests #22562, #22567, #22572, and #22578 in the radare2 project GitHub repository. It is recommended to update to a version containing the aforementioned fixes.
Radare2 version 5.8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HRadare Radare2
APPRadare5.8.8
Related vulnerabilities
Buffer overflow w radare2 — przepełnienie bufora pamięci (CVSS 10.0)
Krytyczny Out-of-bounds Write (heap buffer overflow) w Radare2
Out-of-bounds read w Radare2 – funkcja print_insn32_fpu (NDS32)
Out-of-bounds read w Radare2 — funkcja print_insn32 (NDS32)
Heap-based Buffer Overflow w Radare2 przed wersją 5.9.0