CVE-2020-36404
📋 TL;DR
CVE-2020-36404 is a memory corruption vulnerability in Keystone Engine's SmallVectorImpl destructor that can lead to arbitrary code execution or denial of service. This affects applications using Keystone Engine 0.9.2 for assembly/disassembly functionality. Attackers could exploit this by providing malicious input to trigger the invalid free operation.
💻 Affected Systems
- Keystone Engine
📦 What is this software?
Keystone by Keystone Engine
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or persistent backdoor installation.
Likely Case
Application crash (denial of service) when processing specially crafted assembly code.
If Mitigated
Limited impact if application runs with minimal privileges and proper sandboxing/isolation.
🎯 Exploit Status
The OSS-Fuzz issue includes a proof-of-concept triggering the vulnerability. Exploitation requires understanding of heap manipulation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 0.9.2 (0.9.3 and later)
Vendor Advisory: https://github.com/keystone-engine/keystone/releases
Restart Required: Yes
Instructions:
1. Check current Keystone Engine version. 2. Update to version 0.9.3 or later via package manager or source compilation. 3. Rebuild any applications using Keystone Engine. 4. Restart affected services.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation for assembly code processed by Keystone Engine
Memory Sanitizers
linuxCompile with address sanitizer (ASAN) to detect memory corruption attempts
gcc -fsanitize=address -o program program.c
🧯 If You Can't Patch
- Isolate Keystone Engine processes in containers or sandboxes with minimal privileges
- Implement network segmentation to limit exposure of vulnerable applications
🔍 How to Verify
Check if Vulnerable:
Check if Keystone Engine version is 0.9.2 using package manager or by checking library versionCheck Version:
keystone --version 2>/dev/null || dpkg -l | grep keystone || rpm -qa | grep keystoneVerify Fix Applied:
Verify Keystone Engine version is 0.9.3 or later and test with known problematic inputs📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Memory corruption errors in system logs
- Unexpected process termination
Network Indicators:
- Unusual network traffic to/from applications using Keystone Engine
SIEM Query:
process_name:"keystone" AND (event_type:crash OR error_message:"segmentation fault")🔗 References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22371
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/keystone/OSV-2020-1506.yaml
- https://github.com/keystone-engine/keystone/releases
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22371
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/keystone/OSV-2020-1506.yaml
- https://github.com/keystone-engine/keystone/releases
