CVE-2022-1296 (published 2022-04-11T12:15Z)

Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radareorg/radare2
commit_details: repo_url: https://github.com/radareorg/radare2
author: Sergi Àlvarez i Capilla
author_date: 2022-04-08 20:14:32+02:00
msg: Fix oobread in NE parser ##crash

* Reported by @hmsec via huntr.dev
* Reproducer: necrash
* BountyID: 52b57274-0e1a-4d61-ab29-1373b555fea0/
repository: repo_url: https://github.com/radareorg/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radareorg
file_changes: filename: ne.c
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,6 @@
 /* radare - LGPL - Copyright 2019-2022 - GustavoLCR */
 
 #include "ne.h"
-#define NE_BUG 0
 
 static char *__get_target_os(r_bin_ne_obj_t *bin) {
 	switch (bin->ne_header->targOS) {
@@ -505,25 +504,18 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) {
 					free (reloc);
 					break;
 				}
-				char *name;
-#if NE_BUG
-				if (rel.index > 0 && rel.index < bin->ne_header->ModRefs) {
-					offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable;
-					name = __read_nonnull_str_at (bin->buf, offset);
-				} else {
-					name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ????
-				}
-#else
+				char *name = NULL;
 				if (rel.index > bin->ne_header->ModRefs) {
 					name = r_str_newf ("UnknownModule%d_%x", rel.index, off); // ????
-				} else {
+				} else if (rel.index > 0) {
 					offset = modref[rel.index - 1] + bin->header_offset + bin->ne_header->ImportNameTable;
 					name = __read_nonnull_str_at (bin->buf, offset);
 				}
-#endif
 				if (rel.flags & IMPORTED_ORD) {
 					imp->ordinal = rel.func_ord;
-					imp->name = r_str_newf ("%s.%s", name, __func_name_from_ord(name, rel.func_ord));
+					char *fname = __func_name_from_ord (name, rel.func_ord);
+					imp->name = r_str_newf ("%s.%s", name, fname);
+					free (fname);
 				} else {
 					offset = bin->header_offset + bin->ne_header->ImportNameTable + rel.name_off;
 					char *func = __read_nonnull_str_at (bin->buf, offset);
@@ -566,6 +558,7 @@ RList *r_bin_ne_get_relocs(r_bin_ne_obj_t *bin) {
 				r_list_append (relocs, reloc);
 			} else {
 				do {
+#define NE_BUG 0
 #if NE_BUG
 					if (reloc->paddr + 4 < r_buf_size (bin->buf)) {
 						break;

programming_language: C
filename: ne
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,17 @@
+NAME=NE crash
+FILE=bins/ne/necrash
+CMDS=<<EOF
+aaa
+i~format
+i~csum
+aflc
+EOF
+EXPECT=<<EOF
+format   ne
+hdr.csum c258016a
+0
+EOF
+RUN
 NAME=NE Symbols
 FILE=bins/ne/anim8.exe
 CMDS=is

programming_language: Batchfile