CVE-2018-20457: Medium severity radare2 vulnerability
In radare2 through 3.1.3, the assemble function inside libr/asm/p/asmarmcs.c allows attackers to cause a denial-of-service (application crash via an rnumcalc out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20459.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-20457?
CVE-2018-20457 has been classified as a denial-of-service vulnerability that can lead to application crashes.
How do I fix CVE-2018-20457?
To fix CVE-2018-20457, update radare2 to version 3.1.4 or later, which resolves the out-of-bounds read issue.
Which versions of radare2 are affected by CVE-2018-20457?
CVE-2018-20457 affects radare2 versions up to and including 3.1.3.
What type of attack can exploit CVE-2018-20457?
CVE-2018-20457 can be exploited through crafted ARM assembly input leading to a denial-of-service condition.
Who can be impacted by CVE-2018-20457?
Users of affected versions of radare2 who process ARM assembly code are at risk of encountering this vulnerability.