Описание
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.
A flaw was found in Capstone, a disassembly framework. A local attacker could exploit a heap buffer overflow vulnerability by providing a specially crafted skipdata callback. This flaw occurs because the skipdata length is not properly bounds-checked, which may allow an attacker to write beyond allocated memory, potentially leading to a denial of service (DoS) or arbitrary code execution.
Отчет
This vulnerability is rated Moderate because a heap buffer overflow in the Capstone disassembly framework can be exploited by a local attacker providing a specially crafted skipdata callback, potentially leading to denial of service or arbitrary code execution. Exploitation requires local access and user interaction.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | capstone | Affected | ||
| Red Hat Enterprise Linux 10 | ruby | Not affected | ||
| Red Hat Enterprise Linux 10 | rust | Not affected | ||
| Red Hat Enterprise Linux 8 | ruby:3.3/ruby | Not affected | ||
| Red Hat Enterprise Linux 9 | ruby:3.3/ruby | Not affected | ||
| Red Hat Enterprise Linux 9 | rust | Not affected | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Affected | ||
| Red Hat Enterprise Linux 9 | capstone | Fixed | RHSA-2026:4898 | 18.03.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.
Capstone doesn't check Skipdata length, leading to cs_insn.bytes heap buffer overflow
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prio ...
EPSS
6.1 Medium
CVSS3