CVE-2023-40022

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in `consume_count` of `src/gnu_v2/cplus-dem.c`. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block as unreachable code since the prior statement is multiplication by 10 and fails to consider overflow assuming the count will always be a multiple of 10. Rizin version 0.6.1 contains a fix for the issue. A temporary workaround would be disabling C++ demangling using the configuration option `bin.demangle=false`.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rizinorg/rizin/pull/3753	Patch
https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq	Patch Vendor Advisory
https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419	Product
https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018	Patch
https://github.com/rizinorg/rz-libdemangle/pull/54	Patch
https://github.com/rizinorg/rizin/pull/3753	Patch
https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq	Patch Vendor Advisory
https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419	Product
https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018	Patch
https://github.com/rizinorg/rz-libdemangle/pull/54	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:rizin:rizin:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-08-24 23:15

Updated : 2024-11-21 08:18

NVD link : CVE-2023-40022

Mitre link : CVE-2023-40022

CVE.ORG link : CVE-2023-40022

JSON object : View

Products Affected

rizin

rizin

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2023-40022", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-08-24T23:15:09.177", "references": [{"url": "https://github.com/rizinorg/rizin/pull/3753", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rizinorg/rz-libdemangle/pull/54", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rizinorg/rizin/pull/3753", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/rizinorg/rz-libdemangle/pull/54", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in `consume_count` of `src/gnu_v2/cplus-dem.c`. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block as unreachable code since the prior statement is multiplication by 10 and fails to consider overflow assuming the count will always be a multiple of 10. Rizin version 0.6.1 contains a fix for the issue. A temporary workaround would be disabling C++ demangling using the configuration option `bin.demangle=false`."}], "lastModified": "2024-11-21T08:18:31.870", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rizin:rizin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08C366A2-96F0-48AF-9956-4D145431166F", "versionEndExcluding": "0.6.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}