CVE-2025-8842
📋 TL;DR
A use-after-free vulnerability in NASM Netwide Assembler 2.17rc0 allows local attackers to potentially execute arbitrary code or cause denial of service. The vulnerability exists in the do_directive function of preproc.c and requires local access to exploit. Users and systems running the affected NASM version are at risk.
💻 Affected Systems
- NASM Netwide Assembler
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise or arbitrary code execution with the privileges of the NASM process.
Likely Case
Application crash (denial of service) or limited memory corruption leading to unstable behavior.
If Mitigated
Minimal impact if proper sandboxing and privilege separation are implemented.
🎯 Exploit Status
Exploit has been publicly disclosed but requires local access. Attack complexity is medium due to the need for specific manipulation of the do_directive function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.17rc1 or later
Vendor Advisory: https://bugzilla.nasm.us/show_bug.cgi?id=3392933
Restart Required: No
Instructions:
1. Check current NASM version with 'nasm -v'. 2. If version is 2.17rc0, download and install the patched version from the official NASM repository. 3. Verify installation with 'nasm -v' to confirm version is 2.17rc1 or later.
🔧 Temporary Workarounds
Downgrade to stable version
linuxReplace vulnerable 2.17rc0 with the latest stable release (2.16.01 or earlier)
sudo apt remove nasm
sudo apt install nasm=2.16.01-1
Restrict NASM usage
allLimit execution of NASM to trusted users only using file permissions or access controls
sudo chmod 750 /usr/bin/nasm
sudo chown root:trustedgroup /usr/bin/nasm
🧯 If You Can't Patch
- Implement strict access controls to limit who can execute NASM binaries
- Monitor systems for abnormal NASM process behavior or crashes
🔍 How to Verify
Check if Vulnerable:
Run 'nasm -v' and check if output contains '2.17rc0'Check Version:
nasm -vVerify Fix Applied:
Run 'nasm -v' and confirm version is 2.17rc1 or later, or test with the proof-of-concept exploit to verify it no longer works📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from NASM processes
- Abnormal memory access patterns in system logs
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Process:name='nasm' AND EventID=1000 OR EventID=APPCRASH🔗 References
- https://bugzilla.nasm.us/show_bug.cgi?id=3392933
- https://drive.google.com/file/d/11vEV1vMHXO4BrDGhvWAMm0Qo1woiUwVV/view?usp=drive_link
- https://vuldb.com/?ctiid.319376
- https://vuldb.com/?id.319376
- https://vuldb.com/?submit.623184
- https://bugzilla.nasm.us/show_bug.cgi?id=3392933
- https://vuldb.com/?submit.623184
