Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in modRMRequired() and decode() when disassembling 3DNow! opcodes (0F 0F) in builds compiled with -DCAPSTONE_X86_REDUCE, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence 0F 0F <modrm> <imm8>. Versions 6.0.0-Alpha8 and 5.0.8 patch the issue.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Capstone | Capstone-engine | * | 5.0.8 (excluding) |
| Capstone | Capstone-engine | 6.0.0-alpha1 (including) | 6.0.0-alpha1 (including) |
| Capstone | Capstone-engine | 6.0.0-alpha2 (including) | 6.0.0-alpha2 (including) |
| Capstone | Capstone-engine | 6.0.0-alpha3 (including) | 6.0.0-alpha3 (including) |
| Capstone | Capstone-engine | 6.0.0-alpha4 (including) | 6.0.0-alpha4 (including) |
| Capstone | Capstone-engine | 6.0.0-alpha5 (including) | 6.0.0-alpha5 (including) |
| Capstone | Capstone-engine | 6.0.0-alpha6 (including) | 6.0.0-alpha6 (including) |
| Capstone | Capstone-engine | 6.0.0-alpha7 (including) | 6.0.0-alpha7 (including) |
| Red Hat Hardened Images | RedHat | capstone-main-5.0.8-0.1.hum1 | * |
Potential Mitigations
References
- https://github.com/capstone-engine/capstone/commit/a0201371719b5aaa91d318ab2898843718f92d1f
- https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7
- https://github.com/capstone-engine/capstone/pull/2924
- https://github.com/capstone-engine/capstone/security/advisories/GHSA-289w-cm54-fgrm
- https://github.com/capstone-engine/capstone/security/advisories/GHSA-289w-cm54-fgrm