CVE-2022-36040

Rizin 0.4.0 and prior, UNIX-like, PYC file, out-of-bounds write

• CVSS 7.8
• CWE-787 Out-of-bounds Write
• Memory Corruption
• Local

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from PYC(python) files. A user opening a malicious PYC file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 68948017423a12786704e54227b8b2f918c2fd27 contains a patch.

CVE

CVE-2022-36040

CWE

CWE-787 Out-of-bounds Write

CVSS base score

7.8

Published

2022-09-06

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Memory Corruption

Subcategory

Out-of-Bound Accesses

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to Rizin version 0.4.1 or higher.

def read_pyc(file_path):
    with open(file_path, 'rb') as f:
        magic = f.read(4)
        timestamp = f.read(4)
        
        code_length = f.read(4)
        code_length = int.from_bytes(code_length, byteorder='little')
        
        code_data = f.read(code_length)
        
        process_code_object(code_data)

def process_code_object(code_data):
    pass

def read_pyc(file_path):
    try:
        with open(file_path, 'rb') as f:
            magic = f.read(4)
            timestamp = f.read(4)
            code_length_bytes = f.read(4)
            if len(code_length_bytes) < 4:
                raise ValueError("Invalid PYC file: insufficient data")
            code_length = int.from_bytes(code_length_bytes, byteorder='little')
            
            code_data = f.read(code_length)
            if len(code_data) < code_length:
                raise ValueError("Invalid PYC file: code object is truncated")
            
            process_code_object(code_data)
    
    except Exception as e:
        print(f"Error reading PYC file: {e}")

def process_code_object(code_data):
    pass

@misc{vaitp:cve202236040,
  title        = {{Rizin 0.4.0 and prior, UNIX-like, PYC file, out-of-bounds write}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-36040},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-36040/}}
}