CVE-2024-29645 - Vulnerability Details - OpenCVE

Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Radare	Radare2

No data.

No data.

References

Link	Providers
https://gist.github.com/Crispy-fried-chicken/83f0f5e8a475284d64bf99fb342e9027
https://github.com/radareorg/radare2/commit/72bf3a486fa851797aa21887a40ba0e3d3a6d620
https://github.com/radareorg/radare2/pull/22561

History

Thu, 13 Mar 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Mon, 02 Dec 2024 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Radare Radare radare2
Weaknesses		CWE-120
CPEs		cpe:2.3:a:radare:radare2::::::::
Vendors & Products		Radare Radare radare2
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 02 Dec 2024 14:45:00 +0000

Type	Values Removed	Values Added
Description		Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function.
References		https://gist.github.com/Crispy-fried-chicken/83f0f5e8a475284d64bf99fb342e9027 https://github.com/radareorg/radare2/commit/72bf3a486fa851797aa21887a40ba0e3d3a6d620 https://github.com/radareorg/radare2/pull/22561

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-12-02T00:00:00.000Z

Updated: 2025-03-13T16:05:24.451Z

Reserved: 2024-03-19T00:00:00.000Z

Link: CVE-2024-29645

Vulnrichment

Updated: 2024-12-02T17:31:51.889Z

NVD

Status : Awaiting Analysis

Published: 2024-12-02T15:15:10.960

Modified: 2025-03-13T16:15:18.670

Link: CVE-2024-29645

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-29645", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-03-13T16:05:24.451Z", "dateReserved": "2024-03-19T00:00:00.000Z", "datePublished": "2024-12-02T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-12-02T14:40:04.551Z"}, "descriptions": [{"lang": "en", "value": "Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/radareorg/radare2/commit/72bf3a486fa851797aa21887a40ba0e3d3a6d620"}, {"url": "https://github.com/radareorg/radare2/pull/22561"}, {"url": "https://gist.github.com/Crispy-fried-chicken/83f0f5e8a475284d64bf99fb342e9027"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-120", "lang": "en", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "affected": [{"vendor": "radare", "product": "radare2", "cpes": ["cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "5.8.8", "status": "affected", "lessThan": "5.9.0", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-02T17:24:47.895954Z", "id": "CVE-2024-29645", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-13T16:05:24.451Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-29645", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-02T17:24:47.895954Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*"], "vendor": "radare", "product": "radare2", "versions": [{"status": "affected", "version": "5.8.8", "lessThan": "5.9.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-02T17:31:51.889Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/radareorg/radare2/commit/72bf3a486fa851797aa21887a40ba0e3d3a6d620"}, {"url": "https://github.com/radareorg/radare2/pull/22561"}, {"url": "https://gist.github.com/Crispy-fried-chicken/83f0f5e8a475284d64bf99fb342e9027"}], "descriptions": [{"lang": "en", "value": "Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-12-02T14:40:04.551Z"}}}, "cveMetadata": {"cveId": "CVE-2024-29645", "state": "PUBLISHED", "dateUpdated": "2025-03-13T16:05:24.451Z", "dateReserved": "2024-03-19T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-12-02T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}