CVE-2024-48241
📋 TL;DR
A local denial-of-service vulnerability in radare2's __bf_div function allows attackers to crash the application. This affects users running radare2 versions 5.8.0 through 5.9.4. The vulnerability requires local access to the system where radare2 is installed.
💻 Affected Systems
- radare2
📦 What is this software?
Radare2 by Radare
⚠️ Risk & Real-World Impact
Worst Case
Complete radare2 process crash, potentially disrupting reverse engineering workflows and causing data loss in unsaved analysis sessions.
Likely Case
Temporary denial of service where radare2 crashes when processing malicious input, requiring restart of the application.
If Mitigated
Minimal impact with proper access controls limiting local user privileges and regular saving of analysis work.
🎯 Exploit Status
Exploitation requires local access and ability to trigger the vulnerable function with crafted input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.9.5 and later
Vendor Advisory: https://github.com/radareorg/radare2/issues/23317
Restart Required: No
Instructions:
1. Update radare2 to version 5.9.5 or later using your package manager or from source. 2. For source installation: git clone https://github.com/radareorg/radare2 && cd radare2 && sys/install.sh
🔧 Temporary Workarounds
Restrict local user access
linuxLimit which users can execute radare2 on affected systems
chmod 750 /usr/bin/radare2
setfacl -m u:username:rx /usr/bin/radare2
🧯 If You Can't Patch
- Implement strict access controls to limit which users can run radare2
- Monitor for radare2 process crashes and investigate suspicious local user activity
🔍 How to Verify
Check if Vulnerable:
Check radare2 version with 'r2 -v' and verify if it's between 5.8.0 and 5.9.4Check Version:
r2 -v | grep -o 'radare2 [0-9.]*'Verify Fix Applied:
Verify radare2 version is 5.9.5 or later with 'r2 -v'📡 Detection & Monitoring
Log Indicators:
- radare2 process crashes
- segmentation fault errors in system logs
- abnormal termination of radare2
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
process.name:"radare2" AND event.action:"process_end" AND event.outcome:"failure"