CVE-2022-36042 Rizin Out-of-bounds Write vulnerability in dyld cache binary plugin

2022-09-0600:00:00

CWE-787

GitHub_M

www.cve.org

rizin

out-of-bounds write

dyld cache

vulnerability

code execution

patch

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

35.6%

JSON

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from dyld cache files. A user opening a malicious dyld cache file could be affected by this vulnerability, allowing an attacker to execute code on the user’s machine. Commit number 556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810 contains a patch.

CNA Affected

[
  {
    "vendor": "rizinorg",
    "product": "rizin",
    "versions": [
      {
        "version": "<= 0.4.0",
        "status": "affected"
      }
    ]
  }
]