Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 861524 (CVE-2022-34612) - <dev-util/rizin-0.4.1: integer overflow leading to heap overflow
Summary: <dev-util/rizin-0.4.1: integer overflow leading to heap overflow
Status: RESOLVED FIXED
Alias: CVE-2022-34612
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://github.com/rizinorg/rizin/iss...
Whiteboard: B3 [glsa+]
Keywords:
Depends on:
Blocks:
 
Reported: 2022-07-27 17:30 UTC by John Helmert III
Modified: 2022-09-25 13:57 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-07-27 17:30:04 UTC 
CVE-2022-34612:

Rizin v0.4.0 and below was discovered to contain an integer overflow via the function get_long_object(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary.

Patch: https://github.com/rizinorg/rizin/commit/e645e5827327d945307ddfde4f617ae4c36561fd

Doesn't seem to affect radare2.
Comment 1 Larry the Git Cow gentoo-dev 2022-09-18 21:43:05 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=afc498940ea5697bf841f7f8e052be6ec4768396

commit afc498940ea5697bf841f7f8e052be6ec4768396
Author:     John Helmert III <ajak@gentoo.org>
AuthorDate: 2022-09-18 21:40:45 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-09-18 21:42:57 +0000

    dev-util/rizin: drop 0.4.0-r1
    
    Bug: https://bugs.gentoo.org/861524
    Bug: https://bugs.gentoo.org/868999
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 dev-util/rizin/Manifest                         |  2 -
 dev-util/rizin/files/rizin-0.4.0-capstone.patch | 22 ------
 dev-util/rizin/rizin-0.4.0-r1.ebuild            | 95 -------------------------
 3 files changed, 119 deletions(-)
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-09-19 04:49:36 UTC 
Request filed
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-09-25 13:39:15 UTC 
GLSA released, all done!
Comment 4 Larry the Git Cow gentoo-dev 2022-09-25 13:57:04 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=89088d8ee19407be5e30c10d244979cbc879b19f

commit 89088d8ee19407be5e30c10d244979cbc879b19f
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-09-25 13:33:58 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-09-25 13:42:17 +0000

    [ GLSA 202209-06 ] Rizin: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/861524
    Bug: https://bugs.gentoo.org/868999
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202209-06.xml | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)