Radare2 Double-Free Vulnerability in Radiff2 Component

A memory corruption vulnerability has been identified in Radare2 version 5.9.9, specifically within the radiff2 component. The issue arises in the function r_cons_rainbow_free, located in the library /libr/cons/pal.c. The vulnerability is triggered by manipulating the experimental -T argument, leading to a double-free error. This vulnerability can be exploited locally, and while an exploit is publicly available, the actual existence of the vulnerability is currently disputed.

Impact

Exploitation of this vulnerability causes a double-free error, which can lead to memory corruption.

Reproduction

The vulnerability can be reproduced by compiling Radare2 with AddressSanitizer enabled, and then using the radiff2 tool with the -T option. This triggers the double-free condition in a multi-threaded context, where one thread frees memory that another thread is still using.

Remediation

Users are advised to update to the latest version of Radare2, where this vulnerability has been patched.