Our team’s vulnerability disclosures 2021
At Faraday, we are part of the open-source community. Our product relies on various open-source projects, and it is released under the GNU General Public License. Fortunately, these practices are becoming more common and, with them, open-source software is increasing its presence in data centers, consumer devices, and applications.
But this can have its drawbacks, too, as this xkcd comic illustrates. In particular, some of the software we use daily does not have security in mind. In many cases, these tools started as small side projects or weekend experiments, and their creators did not foresee the popularity they might achieve in the future. Regardless of why this happens, and after reflecting on this, our research team started a new quest to find and report vulnerabilities in the open-source projects we use every day.
These are the vulnerabilities we’ve disclosed during 2021
– CVE-2021–4021: Uncontrolled resource consumption via specially crafted ELF64 binary for MIPS architecture in radare2.
– CVE-2021–4022: Segfault when analyzing an ELF64 for HPPA architecture in rizin.
– CVE-2021–43814: Heap-based OOB write when parsing dwarf DIE info in Rizin.
– CVE-2021–4166: Out-of-bounds Read while loading session in vim.
– CVE-2021–4192: Use After Free while loading session in vim.
– CVE-2021–4193: Out-of-bounds Read while loading session in vim.
Related Posts
February 15, 2024
Good practices in Cybersecurity – Part 1
Pentesters use a comprehensive and complete toolkit to expose different platforms and evaluate the security of an IT infrastructure. They…
January 22, 2024
SADProtocol goes to Hollywood
This research project started when Javier’s wife, our ex Research leader, told him their IP camera had stopped working. Javier was asked to…
December 19, 2023
Farewell 2023
But the outcome of all that is so rewarding. It only placed the bar higher for us, which means we have a tough job for next year. We're…