CVE-2020-27795 Null dereference in radare2
A null pointer dereference in radare2's adf command causes a segmentation fault, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-27795?
CVE-2020-27795 is a high-severity vulnerability in Radare Radare2, published on 19 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A segmentation fault was discovered in radare2 with adf command. In libr/core/cmd_anal.c, when command "adf" has no or wrong argument, anal_fcn_data (core, input + 1) --> RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, -1); returns null pointer for fcn causing segmentation fault later in ensure_fcn_range (fcn).
Weakness: CWE-908
Which versions are affected by CVE-2020-27795?
It affects 1 product.
Products include Radare Radare2.
How do I fix CVE-2020-27795?
No fix has been published for CVE-2020-27795 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-27795 being exploited?
There is no known exploitation of CVE-2020-27795 in the wild and no public exploit code.
Other vulnerabilities in Radare Radare2
Sources
Also known as GHSA-r23c-h6ff-98mj, UBUNTU-CVE-2020-27795.