Radare2 Memory Corruption Vulnerability in Radiff2 Component

A memory corruption vulnerability has been identified in Radare2 version 5.9.9, specifically within the radiff2 component. The issue arises in the function 'r_cons_context_break_pop', located in the library '/libr/cons/cons.c'. The vulnerability is triggered by manipulating the experimental '-T' argument, leading to a double-free error. This issue can only be exploited locally, and while an exploit is publicly available, the vulnerability's existence is currently disputed.

Impact

Exploitation of this vulnerability causes a double-free error, which can lead to memory corruption.

Reproduction

The vulnerability can be reproduced by compiling Radare2 with AddressSanitizer enabled, and then using the radiff2 tool with the '-T' option set to 'POC1' and 'POC2'.

Remediation

Users are advised to update to the patched version of Radare2, which is available on the project's GitHub repository.