CVE-2021-31515
📋 TL;DR
CVE-2021-31515 is an out-of-bounds read vulnerability in Vector 35 Binary Ninja's BNDB file parser that allows remote code execution. Attackers can exploit this by tricking users into opening malicious BNDB files, potentially compromising their systems. This affects Binary Ninja users who open untrusted analysis files.
💻 Affected Systems
- Vector 35 Binary Ninja
📦 What is this software?
Binary Ninja by Vector35
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary code execution with the privileges of the Binary Ninja process, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or malware installation on the user's workstation when opening malicious BNDB files from untrusted sources.
If Mitigated
Limited impact if users only open trusted files and Binary Ninja runs with minimal privileges, though some information disclosure may still occur.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and knowledge of Binary Ninja's file format; ZDI advisory suggests working exploit exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.4.0 and later
Vendor Advisory: https://binary.ninja/2021/06/03/2.4-release.html#security-advisories
Restart Required: Yes
Instructions:
1. Open Binary Ninja. 2. Go to Help → Check for Updates. 3. Install version 2.4.0 or later. 4. Restart Binary Ninja after installation.
🔧 Temporary Workarounds
Restrict BNDB file handling
allConfigure system to open BNDB files only with patched versions or in isolated environments
Run with reduced privileges
allExecute Binary Ninja with limited user permissions to reduce impact of successful exploitation
🧯 If You Can't Patch
- Only open BNDB files from trusted, verified sources
- Use Binary Ninja in isolated virtual machines or containers when analyzing untrusted files
🔍 How to Verify
Check if Vulnerable:
Check Binary Ninja version in Help → About; if version is 2.3.2660 or earlier with Build ID 88f343c3 or older, it's vulnerable.Check Version:
On Linux/macOS: binaryninja --version; On Windows: Check Help → About in GUIVerify Fix Applied:
Verify version is 2.4.0 or later in Help → About and check that BNDB files parse without crashes.📡 Detection & Monitoring
Log Indicators:
- Binary Ninja crash logs with memory access violations
- Unexpected process creation from binaryninja process
Network Indicators:
- Unusual outbound connections from Binary Ninja process
SIEM Query:
process_name:"binaryninja" AND (event_type:"crash" OR parent_process:"binaryninja")