Description
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
NationalSecurityAgency ghidra
Default version status: unaffected
0 to < 12.2affected
pkg:github/nationalsecurityagency/ghidraReferences
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-v423-5vh7-c7jw ↗
- https://github.com/NationalSecurityAgency/ghidra/commit/d105789b331dba84ad73ab92db890e38fe665be0 ↗
- https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build ↗
- https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.4_build/Ghidra/Features/Decompiler/src/decompile/cpp/marshal.cc#L641-L671 ↗
- https://www.vulncheck.com/advisories/ghidra-before-12.2-integer-truncation-in-packeddecode-skipattribute-decompiler-parser ↗