CVE-2021-3674

2023-03-2420:15:08

CWE-119

CWE-125

[email protected]

web.nvd.nist.gov

flaw

rizin

memory corruption

vulnerability

cve-2021-3674

nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

28.3%

JSON

A flaw was found in rizin. The create_section_from_phdr function allocates space for ELF section data by processing the headers. Crafted values in the headers can cause out of bounds reads, which can lead to memory corruption and possibly code execution through the binary object’s callback function.

Affected configurations

NVD

Node

rizinrizinRange≤0.2.1

CPENameOperatorVersion
rizin:rizinrizinle0.2.1

CPE	Name	Operator	Version
rizin:rizin	rizin	le	0.2.1

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "rizin",
    "versions": [
      {
        "version": "affected rizin after version v0.2.1 until commit 1e0c34946dddf9b8e5e63933aefacf2b26d08103",
        "status": "affected"
      }
    ]
  }
]