CVE-2023-30226 Denial of service in n/a
Attackers can cause a denial of service in Rizin by providing a crafted ELF file, affecting users of the reverse engineering tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-30226?
CVE-2023-30226 is a medium-severity denial of service vulnerability in n/a, published on 12 Jul 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0 verneed_entry allows attackers to cause a denial of service via crafted elf file.
Weakness: CWE-834
Which versions are affected by CVE-2023-30226?
It affects 1 product.
Products include Rizin Rizin.
How do I fix CVE-2023-30226?
No fix has been published for CVE-2023-30226 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-30226 being exploited?
There is no known exploitation of CVE-2023-30226 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2024-31668 rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set function in librz/analysis/meta.
- CVE-2023-40022 Rizin vulnerable to Integer Overflow in C++ demangler logic
- CVE-2021-3674 Memory corruption in rizin
- CVE-2023-27590 Rizin has stack-based buffer overflow when parsing GDB registers profile files
- CVE-2022-36039 Out-of-bounds write when parsing DEX files in Rizin
Sources
Also known as GHSA-cp8q-fxv9-rfj5.