Vulnerability · Published Mar 24, 2023 · Assigned by fedora
CVE-2021-3674
High 7.8
In plain English
A high-severity memory corruption in rizin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.4%top 64.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw was found in rizin. The create_section_from_phdr function allocates space for ELF section data by processing the headers. Crafted values in the headers can cause out of bounds reads, which can lead to memory corruption and possibly code execution through the binary object's callback function.
Affected products (as reported)
Weakness: CWE-119, CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H