CVE-2022-28072
📋 TL;DR
A heap buffer overflow vulnerability in the r_read_le32 function of radare2 versions 5.4.2 and 5.4.0 allows attackers to execute arbitrary code or cause denial of service. This affects users who process untrusted binary files with radare2, a reverse engineering framework. The vulnerability occurs when reading malformed input files.
💻 Affected Systems
- radare2
📦 What is this software?
Radare2 by Radare
Radare2 by Radare
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the radare2 process, potentially leading to full system compromise if radare2 runs with elevated privileges.
Likely Case
Application crash (denial of service) when processing malicious files, potentially corrupting analysis results.
If Mitigated
Limited impact if radare2 runs in sandboxed environments with minimal privileges and processes only trusted files.
🎯 Exploit Status
Exploitation requires crafting a malicious binary file that triggers the buffer overflow when parsed by radare2.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 027cd9b7274988bb1af866539ba6c2fa2ff63e45 and later versions
Vendor Advisory: https://github.com/radareorg/radare2/commit/027cd9b7274988bb1af866539ba6c2fa2ff63e45
Restart Required: No
Instructions:
1. Update radare2 to the latest version from the official repository. 2. Rebuild from source if using compiled versions. 3. Verify the fix by checking the commit hash includes 027cd9b7274988bb1af866539ba6c2fa2ff63e45.
🔧 Temporary Workarounds
Avoid processing untrusted files
allRestrict radare2 usage to trusted binary files only.
Run radare2 with reduced privileges
linuxExecute radare2 with non-root/non-admin privileges to limit potential damage.
sudo -u lowprivuser radare2 [file]
🧯 If You Can't Patch
- Downgrade to radare2 version 5.4.1 or earlier, which are not affected.
- Use alternative reverse engineering tools for analyzing untrusted files.
🔍 How to Verify
Check if Vulnerable:
Check radare2 version with 'r2 -v'. If output shows 5.4.2 or 5.4.0, the system is vulnerable.Check Version:
r2 -vVerify Fix Applied:
After updating, verify the commit hash includes 027cd9b7274988bb1af866539ba6c2fa2ff63e45 using 'r2 -V' or check the source code.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from radare2 processes
- Unexpected process termination of radare2
SIEM Query:
ProcessName="radare2" AND (EventID="1000" OR EventID="1001")