Vulnerability · Published Apr 17, 2022 · Assigned by @huntrdev
CVE-2022-1383Heap-based Buffer Overflow in radareorg/radare2
Medium 4.8
In plain English
A medium-severity heap buffer overflow in radareorg/radare2 from radareorg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)4.8Medium
Exploit odds (30 days)0.8%top 44.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | radare2 | 5.6.8-r0 | ALPINE-CVE-2022-1383 |
| Alpine:v3.21 | radare2 | 5.6.8-r0 | ALPINE-CVE-2022-1383 |
| Alpine:v3.22 | radare2 | 5.6.8-r0 | ALPINE-CVE-2022-1383 |
| Alpine:v3.23 | radare2 | 5.6.8-r0 | ALPINE-CVE-2022-1383 |
| Alpine:v3.24 | radare2 | 5.6.8-r0 | ALPINE-CVE-2022-1383 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| radareorg | radareorg/radare2 | unspecified – before 5.6.8 |
Weakness: CWE-122 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
References
- https://huntr.dev/bounties/02b4b563-b946-4343-9092-38d1c5cd60c9 x_refsource_CONFIRM
- https://github.com/radareorg/radare2/commit/1dd65336f0f0c351d6ea853efcf73cf9c0030862 x_refsource_MISC