CVE-2024-29646
📋 TL;DR
A buffer overflow vulnerability in radare2 v5.8.8 allows attackers to execute arbitrary code by manipulating name, type, or group fields. This affects users of radare2 reverse engineering framework. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- radare2
📦 What is this software?
Radare2 by Radare
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, and persistent backdoor installation.
Likely Case
Local privilege escalation or arbitrary code execution when processing malicious files.
If Mitigated
Denial of service or application crash if exploit fails.
🎯 Exploit Status
Proof-of-concept available in GitHub gist. Exploitation requires user to process malicious input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commits via pull requests 22562, 22567, 22572, 22578
Vendor Advisory: https://github.com/radareorg/radare2/security/advisories
Restart Required: No
Instructions:
1. Update radare2 to latest version. 2. If using package manager: 'sudo apt update && sudo apt upgrade radare2' (Debian/Ubuntu) or equivalent. 3. If compiled from source: git pull, rebuild, and reinstall.
🔧 Temporary Workarounds
Input validation wrapper
linuxCreate wrapper script to validate inputs before passing to radare2
#!/bin/bash
# Validate input file exists and is regular file
if [ ! -f "$1" ]; then
echo "Invalid input"
exit 1
fi
radare2 "$1"
🧯 If You Can't Patch
- Restrict radare2 usage to trusted users only
- Run radare2 in sandboxed/containerized environment
🔍 How to Verify
Check if Vulnerable:
Check radare2 version: 'r2 -v' and verify if it's v5.8.8 or earlierCheck Version:
r2 -v | grep versionVerify Fix Applied:
Verify version is newer than v5.8.8 and check git log for fix commits📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Unusual child process spawning from radare2
Network Indicators:
- None - typically local exploitation
SIEM Query:
Process:radare2 AND (EventID:1000 OR ExceptionCode:c0000005)🔗 References
- https://gist.github.com/Crispy-fried-chicken/0be4a204e7226fa2cea761c09f027690
- https://github.com/radareorg/radare2/pull/22562
- https://github.com/radareorg/radare2/pull/22567
- https://github.com/radareorg/radare2/pull/22572
- https://github.com/radareorg/radare2/pull/22578
- https://github.com/radareorg/radare2/pull/22599
