CVE-2023-27590 Rizin has stack-based buffer overflow when parsing GDB registers profile files
Attackers can trigger a stack-based buffer overflow in Rizin by providing malicious GDB register profile files, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-27590?
CVE-2023-27590 is a high-severity memory corruption vulnerability in rizinorg rizin, published on 14 Mar 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Rizin is a UNIX-like reverse engineering framework and command-line toolset. In version 0.5.1 and prior, converting a GDB registers profile file into a Rizin register profile can result in a stack-based buffer overflow when the `name`, `type`, or `groups` fields have longer values than expected. Users opening untrusted GDB registers files (e.g. with the `drpg` or `arpg` commands) are affected by this flaw. Commit d6196703d89c84467b600ba2692534579dc25ed4 contains a patch for this issue. As a workaround, review the GDB register profiles before loading them with `drpg`/`arpg` commands.
Which versions are affected by CVE-2023-27590?
It affects 1 product.
Products include Rizin Rizin.
How do I fix CVE-2023-27590?
No fix has been published for CVE-2023-27590 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-27590 being exploited?
There is no known exploitation of CVE-2023-27590 in the wild and no public exploit code.
Other vulnerabilities in rizinorg rizin
- CVE-2024-31668 rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set function in librz/analysis/meta.
- CVE-2023-40022 Rizin vulnerable to Integer Overflow in C++ demangler logic
- CVE-2021-3674 Memory corruption in rizin
- CVE-2022-36039 Out-of-bounds write when parsing DEX files in Rizin
- CVE-2022-36040 Rizin Out-of-bounds Write vulnerability in pyc/marshal.c
Sources
Also known as GHSA-rqcp-m8m2-jcqf.