CVE-2017-10929: Buffer Overflow

Published Jul 5, 2017

Updated

The grubmemmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, possibly related to a read overflow in the grubdiskreadsmallreal function in kern/disk.c in GNU GRUB 2.02.

Affected Software

1 affected component

Radare Radare2=1.5.0

Remediation

Patch Available

https://github.com/radare/radare2/commit/c57997e76ec70862174a1b3b3aeb62a6f8570e85

Event History

Jul 5, 2017

CVE Published

via MITRE·12:00 PM

Data Sourced

via MITRE·12:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-10929?

CVE-2017-10929 has a high severity rating as it can lead to a heap-based buffer overflow and application crash.

How do I fix CVE-2017-10929?

To mitigate CVE-2017-10929, upgrade to a version of radare2 that is patched against this vulnerability.

What does CVE-2017-10929 affect?

CVE-2017-10929 specifically affects radare2 version 1.5.0.

Can CVE-2017-10929 be exploited remotely?

Yes, CVE-2017-10929 can be exploited remotely by attackers using crafted binary files.

What are the consequences of CVE-2017-10929?

The consequences of CVE-2017-10929 include denial of service and potential crashes of the affected application.