Description
AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
sshock AFFLIB
Default version status: unaffected
0 to ≤ 3.7.22affected
pkg:github/sshock/AFFLIBv3References
- https://github.com/sshock/AFFLIBv3/issues/61 ↗
- https://github.com/sshock/AFFLIBv3/blob/v3.7.22/lib/afflib_pages.cpp#L309-L315 ↗
- https://hackmd.io/@haindpwn/afflib-aff-get-page-sector-fill-oob-write ↗
- https://github.com/sshock/AFFLIBv3 ↗
- https://www.vulncheck.com/advisories/afflib-through-3.7.22-heap-out-of-bounds-write-in-af-get-page ↗