Vulnerability · Published Dec 26, 2021 · Assigned by mitre

CVE-2021-44078

High 8.1

In plain English

A high-severity security flaw in the unicorn package (PyPI). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.1High

Exploit odds (30 days)0.5%top 54.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obtain the ability to execute crafted code in the target sandbox in order to exploit this vulnerability. The specific flaw exists within the virtual memory manager. The issue results from the faulty comparison of GVA and GPA while calling uc_mem_map_ptr to free part of a claimed memory block. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code on the host machine.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	unicorn	2.0.0rc1	PYSEC-2021-868

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.unicorn-engine.org/changelog/ x_refsource_MISC
https://gist.github.com/jwang-a/cb4b6e9551457aa299066076b836a2cd x_refsource_MISC
https://github.com/unicorn-engine/unicorn/commit/c733bbada356b0373fa8aa72c044574bb855fd24 x_refsource_MISC
https://github.com/jwang-a/CTF/blob/master/MyChallenges/Pwn/Unicorns_Aisle/UnicornsAisle.pdf x_refsource_MISC
https://github.com/unicorn-engine/unicorn/compare/2.0.0-rc4...2.0.0-rc5 x_refsource_CONFIRM