ASA-202204-4: rizin: multiple issues
Arch Linux Security Advisory ASA-202204-4
Date : 2022-04-04
CVE-ID : CVE-2021-4022 CVE-2021-43814
Package : rizin
Type : multiple issues
Remote : No
Link : https://security.archlinux.org/AVG-2590
The package rizin before version 0.3.2-1 is vulnerable to multiple
issues including arbitrary code execution and denial of service.
Upgrade to 0.3.2-1.
# pacman -Syu "rizin>=0.3.2-1"
The problems have been fixed upstream in version 0.3.2.
- CVE-2021-4022 (denial of service)
A specially crafted binary can make Rizin segfault when it tries to
analyze it (doing a full analysis with aaa). In
rz_core_analysis_type_match retctx structure was initialized on the
stack only after a "goto out_function", where a field of that structure
was freed. When the goto path is taken, the field is not properly
initialized and it could cause a crash of Rizin or have other effects.
- CVE-2021-43814 (arbitrary code execution)
In Rizin versions up to and including 0.3.1 there is a heap-based out
of bounds write in parse_die() when reversing an AMD64 ELF binary with
DWARF debug info. When a malicious AMD64 ELF binary is opened by a
victim user, Rizin may crash or execute unintended actions.
An attacker is able to provide a malicious AMD64 ELF binary that when
opened by a victim may execute arbitrary code on the affected host.
A rizin security update has been released for Arch Linux.