Описание
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public cs_insn_name() API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.
A flaw was found in Capstone. The cs_insn_name() application programming interface (API) in the M68K and RISCV backends does not properly validate caller-supplied instruction IDs. An attacker can provide an invalid instruction ID, leading to an out-of-bounds read. This can cause the process to crash, resulting in a denial of service (DoS) for applications that expose instruction-name lookup to untrusted IDs.
Отчет
Moderate: This flaw in Capstone's M68K and RISCV backends can lead to a denial of service. Applications that utilize Capstone and expose the cs_insn_name() API to untrusted instruction IDs without proper validation are susceptible to an out-of-bounds read, resulting in a crash. The impact is limited to availability and does not involve code execution or information disclosure.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | capstone | Will not fix | ||
| Red Hat Enterprise Linux 9 | capstone | Will not fix | ||
| Red Hat Hardened Images | capstone | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
6.2 Medium
CVSS3
Связанные уязвимости
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have missing or incomplete bounds checks. On a Capstone handle opened for M68K or RISCV, a caller-controlled invalid instruction ID can trigger an out-of-bounds read and crash the process. The demonstrated impact is availability loss in applications or bindings that expose instruction-name lookup to untrusted IDs. No code execution or data disclosure was demonstrated. Version 6.0.0-Alpha9 patches the issue.
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Ca ...
6.2 Medium
CVSS3