Radare2 Double-Free Vulnerability in Radiff2 Component

A double-free vulnerability has been identified in Radare2 version 5.9.9, specifically within the radiff2 component. The issue arises in the function r_cons_pal_init, located in the file /libr/cons/pal.c. The vulnerability is triggered by manipulating the experimental -T argument, leading to memory corruption. This vulnerability must be exploited locally, and while the exploitation is considered difficult, it has been publicly disclosed and may be used.

Impact

Exploitation of this vulnerability causes a double-free error, which can lead to memory corruption.

Reproduction

The vulnerability can be reproduced by compiling Radare2 with AddressSanitizer enabled, which helps detect memory corruption issues. After compiling and installing Radare2, the radiff2 tool can be run with the -T option set to 'POC1', which triggers the double-free vulnerability. This can be done by using a specific command that includes the -T option along with other parameters that radiff2 accepts.

Remediation

Users are advised to update to Radare2 version 6.0.2, where this vulnerability has been fixed.