CVE-2022-0559CWE-416

Use After Free in radareorg/radare2

High · published February 16, 2022

CVSS v3.0
8.4
EPSS
1%
Percentile
69.4
In the wild
Unconfirmed
What it is

⚡ A use-after-free vulnerability in radare2 could turn your analysis tools into a hacker's playground! 🔍 Think of this as a busy restaurant where a waiter accidentally serves dishes that have already been cleared from the table — someone could get served yesterday's leftovers instead of fresh meals. 🍽️ An attacker could exploit this flaw to manipulate memory, potentially leading to arbitrary code execution or crashes. It's like ordering a dish that comes with an unexpected side of chaos! Imagine the havoc if a rogue chef could tamper with your orders behind the scenes!

Put simply

Think of this as a busy restaurant where a waiter accidentally serves dishes that have already been cleared from the table — someone could get served yesterday's leftovers instead of fresh meals. 🍽️ This vulnerability arises when the radare2 tool improperly manages memory, allowing an attacker to exploit already freed memory to execute arbitrary code or alter the program's behavior.

What to do

An attacker could exploit this flaw to manipulate memory, potentially leading to arbitrary code execution or crashes. It's like ordering a dish that comes with an unexpected side of chaos! Imagine the havoc if a rogue chef could tamper with your orders behind the scenes! Upgrade to radare2 version 5.6.2 or later to patch this issue immediately. Regularly audit your system for outdated components and check for known vulnerabilities to keep your tools secure! You've got this! With a quick update, you'll keep your analysis tools running safely and smoothly. 🛡️

The record
Technical detail
CVSS v3.0
8.4 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01262 · 69.4th percentile
Weakness
CWE-416 · Use After Free
Published
2022-02-16T10:15Z
EPSS history
Timeline
  • 16 FEB 10:15Z
    Use After Free in radareorg/radare2
    cvelistv5