Vulnerability · Published Aug 24, 2023 · Assigned by GitHub_M

CVE-2023-40022Rizin vulnerable to Integer Overflow in C++ demangler logic

High 7.8

In plain English

A high-severity integer overflow in rizin from rizinorg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.3%top 78.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in `consume_count` of `src/gnu_v2/cplus-dem.c`. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block as unreachable code since the prior statement is multiplication by 10 and fails to consider overflow assuming the count will always be a multiple of 10. Rizin version 0.6.1 contains a fix for the issue. A temporary workaround would be disabling C++ demangling using the configuration option `bin.demangle=false`.

Affected products (as reported)

Vendor	Product	Versions
rizinorg	rizin	< 0.6.1

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq x_refsource_CONFIRM
https://github.com/rizinorg/rizin/pull/3753 x_refsource_MISC
https://github.com/rizinorg/rz-libdemangle/pull/54 x_refsource_MISC
https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018 x_refsource_MISC
https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419 x_refsource_MISC