radare2 vulnerabilities

Version 6.1.5 of radare2 contains a use-after-free vulnerability in the gdbr_pids_list() function, which can be exploited by remote attackers to cause a denial of service or potentially execute arbitrary code by sending malformed thread information responses.

radare2 version 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function. This allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response.

In radare2 version 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verdef() in elf.c, which can be triggered by crafted ELF files when parsing the ELF version on 32-bit systems.

In radare2 version 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verneed() in elf.c, which can be exploited via crafted ELF files on 32-bit systems.

The store_versioninfo_gnu_verdef function in radare2 2.0.0 allows remote attackers to cause a denial of service via a crafted ELF file, leading to an invalid write in r_read_le16 and application crash.

The wasm_dis function in radare2 version 2.0.0 allows remote attackers to cause denial of service through stack-based buffer over-read, leading to application crash. The attack can be executed using a crafted WASM file that triggers an incorrect r_hex_bin2str call.

The grub_memmove function in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted binary file.

The grub_memmove function in radare2 1.5.0 allows remote attackers to cause a denial of service via a crafted binary file, potentially leading to application crashes due to a buffer underflow.

The dalvik_disassemble function in radare2 version 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.

The relocs function in libr/bin/p/bin_bflt.c in radare2 version 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 version 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.

A vulnerability was detected in radareorg radare2 in the r_core_cmd_str_pipe function of libr/core/rtr_http.inc.c, related to the HTTP sandbox policy handler. Manipulation results in a protection mechanism failure, and remote exploitation is possible though highly complex. The issue is fixed in version 6.2.4 (commit 18fd12efa98a7d1977de7bdd379d8a848777b90f).

In radare2 prior to 6.2.0, the Windows 64-bit crash-dump (dmp64) parser was vulnerable because it used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loop. The vulnerability is triggered by opening a small crafted full-memory Windows crash dump. The parser repeatedly allocated and appended page descriptors without validating the count against the dump size, causing denial of service through excessive memory consumption and processing time.

In radare2 prior to 6.2.0, the NE relocation fixup-chain parser was vulnerable because it followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration, causing denial of service through continuous CPU and memory consumption.

radare2 before version 6.2.0 has a vulnerability in the Mach-O LC_DATA_IN_CODE parser that trusts dataoff and datasize, potentially leading to a heap out-of-bounds read when processing a crafted file. The attack requires the bin.verbose option to be enabled. It may cause process termination, but no memory disclosure has been demonstrated.

radare2 before version 6.2.0 has a vulnerability in the Lua 5.3 bytecode function parser that reads fixed metadata fields without checking remaining buffer length. When opening a crafted file with a function name ending at the buffer boundary, the parser reads beyond allocated memory, possibly causing incorrect results or process termination.

radare2 before version 6.2.0 has a vulnerability in the binary property-list Unicode parser that underallocates memory and does not guarantee NUL termination. Running pFB or pFBj commands on untrusted data can cause out-of-bounds reads, leading to disclosure of uninitialized or adjacent heap contents in JSON output or process termination.

radare2 before version 6.2.0 has a vulnerability in the Mach-O Swift field-metadata parser where a relative pointer can be lower than the section base, leading to a negative index. When parsing metadata from a crafted file, the parser reads four bytes before the buffer, possibly causing incorrect processing or process termination.

In radare2 prior to 6.2.0, the Apple Preferred Executable Format (PEF) loader was vulnerable because it accepted relocSecCount values not bounded by the number of sections or complete relocation records in the input. The vulnerability is triggered by normal binary-format auto-detection of a small crafted Apple PEF file. The loader could perform up to 268,435,456 relocation-section iterations and repeated buffer operations after record offsets passed the end of the file, causing denial of service through excessive CPU consumption and prolonged processing.

In radare2 prior to 6.2.0, ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but several consumers still iterated with the original e_phnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with e_phnum = 0xffff and a much smaller resolved count in shdr[0].sh_info. Consumers iterated beyond the allocated program-header array, causing a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated.

In radare2 prior to 6.2.0, the CPython bytecode .pyc marshal parser was vulnerable because the CPython marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocation. The vulnerability is triggered by opening or inspecting a crafted .pyc file through r2 or rabin2. A length of 0xffffffff wrapped the allocation to zero before the common byte reader wrote attacker-controlled data and fill bytes beyond the heap allocation, causing heap memory corruption and denial of service; arbitrary code execution is possible but has not been demonstrated.

A vulnerability was found in radare2 up to version 6.1.6 in the Memory64ListStream parser within mdmp.c. A local attacker can trigger a stack-based buffer overflow by manipulating input data. The exploit is publicly available.

A use-after-free vulnerability has been detected in radare2 up to version 6.1.6 in the function r_core_bin_load within libr/core/cfile.c. The attack requires local access and the exploit has been publicly disclosed.

A vulnerability has been found in radareorg radare2 up to version 6.1.6, involving an integer overflow in the cmd_print function within the pb Print Command Handler component. The attack requires local access and a public exploit is available.

A security flaw in radare2 up to version 6.1.6 affects the r_str_word_get0set function in libr/util/str.c, causing an integer overflow. The attack requires local access and a public exploit is available.

A security vulnerability has been detected in radareorg radare2 up to version 6.1.6, involving an integer overflow in the r_str_ndup/r_str_append functions in libr/util/str.c. The attack requires local access and the exploit has been publicly disclosed.

A use-after-free vulnerability has been found in radare2 up to version 6.1.6 in the function r_core_seek_arch_bits within libr/core/disasm.c, specifically in the regprofile handler component.

A heap-based buffer overflow vulnerability was discovered in radare2 up to version 6.1.6 in the r_bin_java_inner_classes_attr_calc_size function of shlr/java/class.c, part of the RBinJava Line Number Table Parser. Local manipulation triggers the overflow, and a public exploit exists.

A vulnerability was found in radare2 up to version 6.1.6 in the cmd_anal_opcode function of libr/core/cmd_anal.inc.c within the hexpairs Parser component. Data manipulation leads to an integer overflow. The attack requires local access and the exploit is publicly available.

A vulnerability in radare2 up to version 6.1.6 was found in the core_anal_bytes function of libr/core/cmd_anal.inc, causing an integer overflow. The attack requires local access and has been publicly disclosed.

radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to read or write files outside the configured project directory by importing a malicious .zrp archive containing a symlinked notes.txt file. Attackers can bypass directory confinement checks, allowing note operations to follow the symlink and access arbitrary files outside the dir.projects root directory.

A command injection vulnerability was found in radare2 prior to commit bc5a890 in the afsv/afsvj command path. Malicious ELF binaries can embed r2 command sequences as DWARF DW_TAG_formal_parameter names, which execute when the binary is analyzed with aaa and afsvj, allowing arbitrary shell command execution through unsanitized parameter interpolation in the pfq command string.

radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.