Our team’s vulnerability disclosures 2021

At Faraday, we are part of the open-source community. Our product relies on various open-source projects, and it is released under the GNU General Public License. Fortunately, these practices are becoming more common and, with them, open-source software is increasing its presence in data centers, consumer devices, and applications.
But this can have its drawbacks, too, as this xkcd comic illustrates. In particular, some of the software we use daily does not have security in mind. In many cases, these tools started as small side projects or weekend experiments, and their creators did not foresee the popularity they might achieve in the future. Regardless of why this happens, and after reflecting on this, our research team started a new quest to find and report vulnerabilities in the open-source projects we use every day.
These are the vulnerabilities we’ve disclosed during 2021
– CVE-2021–4021: Uncontrolled resource consumption via specially crafted ELF64 binary for MIPS architecture in radare2.
– CVE-2021–4022: Segfault when analyzing an ELF64 for HPPA architecture in rizin.
– CVE-2021–43814: Heap-based OOB write when parsing dwarf DIE info in Rizin.
– CVE-2021–4166: Out-of-bounds Read while loading session in vim.
– CVE-2021–4192: Use After Free while loading session in vim.
– CVE-2021–4193: Out-of-bounds Read while loading session in vim.
Related Posts
February 1, 2023
Security Orchestration, the key to Vulnerability Management
Whether your IT department or security team needs to operate and protect your system and data, vulnerability management tools are the way…
January 12, 2023
Release v4.3.2
We started 2023 with fresh and new fixes. One of the most awaited features in this release is the "Trending" category to the enrichment…
January 9, 2023
2022 Recap: our most read article
A new year means new opportunities but also new vulnerabilities, and we're hoping 2023 gives rise to some much-needed progress and safer…