Radare2 Memory Corruption Vulnerability in Radiff2 Component

A memory corruption vulnerability has been identified in Radare2 version 5.9.9, specifically within the radiff2 component. The issue arises in the 'cons_stack_load' function of the '/libr/cons/cons.c' library, where the manipulation of the experimental '-T' argument leads to memory corruption. This vulnerability requires local exploitation and has a high attack complexity. Although the existence of this vulnerability is currently disputed, a public exploit is available as a proof-of-concept.

Impact

Exploitation of this vulnerability causes a double-free condition, which can lead to memory corruption.

Reproduction

The vulnerability can be reproduced by compiling Radare2 with AddressSanitizer enabled, and then using the radiff2 tool with the '-T' option set to a specific value that triggers the vulnerability. The AddressSanitizer will report the double-free error, indicating that the vulnerability has been successfully exploited.

Remediation

Users are advised to update to the patched version of Radare2. The patch is available in the official Radare2 repository on GitHub.