CVE-2021-32494
📋 TL;DR
CVE-2021-32494 is a division by zero vulnerability in Radare2's Mach-O parser that allows attackers to cause denial of service through malicious inputs. This affects users who process untrusted Mach-O files with vulnerable Radare2 versions. The vulnerability can crash the application when parsing specially crafted files.
💻 Affected Systems
- radare2
📦 What is this software?
Radare2 by Radare
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service causing Radare2 to crash when processing malicious Mach-O files, potentially disrupting reverse engineering workflows or automated analysis systems.
Likely Case
Application crash when processing malicious Mach-O files, requiring restart of Radare2 and potential loss of unsaved work.
If Mitigated
No impact if patched version is used or if untrusted Mach-O files are not processed.
🎯 Exploit Status
Exploitation requires providing a malicious Mach-O file to Radare2. The vulnerability is well-documented in public repositories with proof-of-concept examples available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit a07dedb804a82bc01c07072861942dd80c6b6d62 and later, Radare2 5.4.0 and later
Vendor Advisory: https://github.com/radareorg/radare2/commit/a07dedb804a82bc01c07072861942dd80c6b6d62
Restart Required: No
Instructions:
1. Update Radare2 to version 5.4.0 or later. 2. If using git version, ensure commit a07dedb804a82bc01c07072861942dd80c6b6d62 is included. 3. Recompile if building from source.
🔧 Temporary Workarounds
Avoid processing untrusted Mach-O files
allDo not use Radare2 to analyze untrusted Mach-O binary files until patched.
🧯 If You Can't Patch
- Restrict Radare2 usage to trusted Mach-O files only
- Implement file validation/sandboxing for Mach-O file processing
🔍 How to Verify
Check if Vulnerable:
Check Radare2 version with 'r2 -v' and verify it's older than 5.4.0, or check if commit a07dedb804a82bc01c07072861942dd80c6b6d62 is not in your build.Check Version:
r2 -vVerify Fix Applied:
Update to Radare2 5.4.0 or later and verify version with 'r2 -v', or test with known malicious Mach-O files that previously caused crashes.📡 Detection & Monitoring
Log Indicators:
- Radare2 crash logs when processing Mach-O files
- SIGFPE (floating point exception) signals
Network Indicators:
- N/A - local tool vulnerability
SIEM Query:
Process:radare2 AND (EventID:1000 OR Signal:SIGFPE)