Bug 2181965 (CVE-2021-3674)

Summary:	CVE-2021-3674 rizin: oob reads to code execution
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-03-27 10:05:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2181966, 2181967
Bug Blocks:	2181815

Description Sandipan Roy 2023-03-27 05:52:34 UTC

A flaw was found in rizin. The create_section_from_phdr function allocates space for ELF section data by processing the headers. Crafted values in the headers can cause out of bounds reads, which can lead to memory corruption and possibly code execution through the binary object's callback function.

https://gist.github.com/netspooky/61101e191afee95feda7dbd2f6b061c4
https://github.com/rizinorg/rizin/pull/1313

Comment 1 Sandipan Roy 2023-03-27 05:52:56 UTC

Created rizin tracking bugs for this issue:

Affects: epel-8 [bug 2181966]
Affects: fedora-all [bug 2181967]

Comment 2 Product Security DevOps Team 2023-03-27 10:05:39 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.