CVE-2022-28070
📋 TL;DR
A null pointer dereference vulnerability in radare2's __core_anal_fcn function allows attackers to cause denial of service or potentially execute arbitrary code by crashing the application. This affects users of radare2 versions 5.4.0 and 5.4.2 who analyze untrusted binary files.
💻 Affected Systems
- radare2
📦 What is this software?
Radare2 by Radare
Radare2 by Radare
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if combined with other vulnerabilities or memory corruption techniques.
Likely Case
Application crash (denial of service) when processing specially crafted binary files.
If Mitigated
Limited to denial of service with proper sandboxing and input validation.
🎯 Exploit Status
Exploitation requires crafting a malicious binary file that triggers the null pointer dereference. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.4.3 and later
Vendor Advisory: https://github.com/radareorg/radare2/commit/4aff1bb00224de4f5bc118f987dfd5d2fe3450d0
Restart Required: No
Instructions:
1. Update radare2 to version 5.4.3 or later using your package manager. 2. For source installations: git pull from the radare2 repository and rebuild. 3. Verify the fix by checking the version with 'r2 -v'.
🔧 Temporary Workarounds
Avoid untrusted binary analysis
allDo not use radare2 to analyze untrusted or unknown binary files until patched.
Use sandboxed environment
linuxRun radare2 in a container or virtual machine when analyzing potentially malicious binaries.
docker run --rm -it radareorg/radare2:latest
🧯 If You Can't Patch
- Restrict radare2 usage to trusted binaries only
- Implement strict file validation and scanning before analysis
🔍 How to Verify
Check if Vulnerable:
Check radare2 version with 'r2 -v'. If version is 5.4.0 or 5.4.2, the system is vulnerable.Check Version:
r2 -vVerify Fix Applied:
After updating, verify version is 5.4.3 or later with 'r2 -v'.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from radare2 process
- Abnormal termination of radare2 sessions
Network Indicators:
- Not applicable - local tool
SIEM Query:
Process:radare2 AND (EventID:1000 OR Signal:SIGSEGV)