CVE-2022-36040

Executive Summary

CVE-2022-36040 is an out-of-bounds write vulnerability in Rizin, a UNIX-like reverse engineering framework and command-line toolset, affecting versions 0.4.0 and prior. The flaw exists in the Python bytecode (PYC) file parsing logic, specifically within the pyc/marshal.c module, and can be triggered when a user opens a malicious PYC file. Successful exploitation grants an attacker arbitrary code execution on the victim's machine with the privileges of the user running Rizin, with a CVSS score of 7.8 (High). A patch exists in commit 68948017423a12786704e54227b8b2f918c2fd27, though the patch confidence remains at 0/4 from tracked sources, and there is no current evidence of exploitation in the wild or inclusion in CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

The vulnerability resides in Rizin's PYC (Python Compiled) file parser, specifically in the pyc/marshal.c component, as indicated by the CNA title. PYC files are the compiled bytecode output of Python source files, a format commonly encountered during reverse engineering of Python applications and malware analysis. Rizin, as a reverse engineering framework, processes these files to disassemble Python bytecode for analysis.

The flaw is classified as an out-of-bounds write (CWE-787). When parsing marshalled data structures within PYC files, the vulnerable code path does not properly validate bounds before performing memory write operations. An attacker who crafts a malicious PYC file with malformed or oversized marshalled data structures can cause Rizin to write data beyond the boundaries of an allocated buffer. This memory corruption can lead to:

1. Memory corruption — overwriting adjacent heap metadata or application data structures.
2. Arbitrary code execution — by corrupting function pointers, return addresses, or heap structures to redirect execution flow.
3. Denial of service — via application crash from corrupted memory state.

The exact trigger mechanism involves the deserialization of Python marshal data. Python's marshal format is a binary serialization protocol for Python objects. Crafted objects containing inconsistent length fields or deeply nested structures can cause the parser to miscalculate required buffer sizes, leading to a write beyond allocated bounds.

Technical detail limitations: The NVD description does not specify the exact function names, buffer allocation routines, or the precise marshalled type that triggers the overflow. The following technical characteristics are evident from the data provided:

• Affected component: pyc/marshal.c
• Vulnerability class: Out-of-bounds write (CWE-787)
• Attack vector: Local, via file opening (user interaction required)
• Privileges required: None beyond opening the file
• Impact: High confidentiality, integrity, and availability impact

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and standard exploitation patterns for file-parsing memory corruption vulnerabilities.

Attack Chain:

1. Reconnaissance and Target Identification: The attacker identifies a target who uses Rizin for reverse engineering or security analysis work. This typically includes malware analysts, security researchers, CTF players, and software developers working with Python-compiled binaries. The attacker may determine this through professional social networks, public research repositories, or organizational profiling.

2. Triggering the Flaw: The attacker crafts a malicious PYC file that contains specially constructed Python marshal data designed to exploit the out-of-bounds write in pyc/marshal.c. The crafted PYC file need not be valid Python bytecode in the traditional sense; it only needs to be structurally plausible enough for Rizin to attempt parsing it. The attacker delivers this file through common distribution channels: email attachments, download links, embedded in archives, or bundled with compromised projects.

3. Payload Execution: When the victim opens the malicious PYC file in Rizin (e.g., by running rizin file.pyc, dragging the file onto the Rizin GUI, or programmatically loading it via Rizin's library API), the vulnerable parser processes the marshalled data. The out-of-bounds write corrupts memory, and the attacker's embedded payload — crafted to leverage the specific memory corruption — redirects execution flow to attacker-controlled shellcode. Given the CVSS vector indicating no privileges required and user interaction, the payload executes with the privileges of the user running Rizin.

4. Post-Exploitation Impact: Upon successful code execution, the attacker gains a foothold on the victim's machine. Given Rizin's typical usage in security research, the compromised machine likely contains sensitive information: unreported vulnerability research, client data, analysis of malicious software, or intellectual property. The attacker can establish persistence, exfiltrate data, pivot within the network, or use the compromised researcher as a supply-chain vector to inject malware into their analysis deliverables.

Scenario Example: An attacker targets a security consulting firm known for reverse engineering Python-based malware. They craft a malicious PYC file disguised as a Python-compiled malware sample and post it to a public malware repository. A Rizin-using analyst downloads and opens the file for analysis. The exploit triggers, giving the attacker initial access to the analyst's workstation and, subsequently, the firm's internal network.

Impact Assessment

CVSS Analysis: The vulnerability scores 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

• Attack Vector: Local (AV:L) — The file must be opened locally by Rizin.
• Attack Complexity: Low (AC:L) — No special conditions required beyond opening the file.
• Privileges Required: None (PR:N) — Any user-level account can trigger the flaw.
• User Interaction: Required (UI:R) — The victim must open the malicious file.
• Impact: High confidentiality, integrity, and availability — full system compromise is plausible.

Business Impact: For organizations performing reverse engineering, the compromise of an analyst workstation threatens operational security, client confidentiality, and intellectual property. A successful exploit can undermine the integrity of security research and provide adversaries with insight into defensive capabilities.

Affected Systems: All Rizin installations on versions 0.4.0 and prior across platforms (Linux, Windows, macOS, BSD variants). Because Rizin is often distributed as a standalone binary or package, the exact affected ecosystem is broad.

Blast Radius: The attack requires local file access, limiting remote exploitability. However, the impact is amplified by the target profile — security researchers and analysts are high-value targets for advanced adversaries seeking intelligence on vulnerability research or access to sensitive client environments.

EPSS Assessment: With an EPSS score of 0.00364 (29.2% percentile), this vulnerability currently has a low probability of exploitation in the wild, consistent with the lack of public PoC and CISA KEV inclusion.

Detection Guidance

Sigma Rule

title: Rizin PYC File Parsing Exploitation Attempt
id: 7161520c-abcd-4e2d-9f4a-2c7f8a9773d2
status: experimental
description: Detects Rizin process launching with a .pyc file argument, potentially indicating exploitation of CVE-2022-36040 (out-of-bounds write in pyc/marshal.c)
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-36040
author: ValtersIT Threat Intelligence
date: 2024/01/15
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\rizin.exe'
        CommandLine|contains: '.pyc'
    condition: selection
level: medium
falsepositives:
    - Legitimate analysis of Python bytecode files
    - Security researchers performing routine reverse engineering
tags:
    - attack.execution
    - attack.t1203

YARA Rule

rule Rizin_PYC_Exploit_CVE_2022_36040 {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects malicious PYC files potentially exploiting CVE-2022-36040 out-of-bounds write in Rizin pyc/marshal.c"
        date = "2024-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-36040"
        severity = "high"
    strings:
        $pyc_magic = { 6F 0D 0D 0A }  // Python bytecode magic \r\n
        $marshal_marker = { 28 01 00 00 00 }  // Unusual marshal object length indicators
        $large_type = { 7A FF FF FF FF }  // Potentially oversized marshalled string type
        $pyc_header = { E3 0C 0D 0A }  // Python 3.7+ header
    condition:
        uint32(0) == 0x0D0A0D0A or
        ($pyc_magic at 0 and $marshal_marker and $large_type) or
        ($pyc_header at 0 and filesize < 5MB)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET MALWARE Rizin PYC Exploit Download Attempt CVE-2022-36040"; flow:established,to_client; filemagic:"Python bytecode"; fileext:"pyc"; content:"rizin"; nocase; reference:cve,2022-36040; classtype:attempted-user; sid:202236040; rev:1;)

Note: The rule above uses generic file attributes. In practice, the exploitation occurs locally after file download. Network detection focuses on the delivery mechanism.

Elastic Detection

/* Detect Rizin process execution with PYC files - potential CVE-2022-36040 exploitation */
process where process.name == "rizin.exe" and
  process.args : "*.pyc" and
  /* Look for abnormal memory behavior or rapid crashes */
  (event.action == "process_created" or
   event.category == "process" and event.type == "start")
| where user.id != "0"  /* Non-root execution */

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| where EventCode=4688
| search (New_Process_Name="*rizin.exe" OR New_Process_Name="*rizin")
| search CommandLine="*.pyc*"
| stats count by user, ComputerName, New_Process_Name, CommandLine, _time
| sort -_time

Wazuh OSSEC Rule

<group name="rizin_exploitation,">
    <rule id="100240" level="10">
        <decoded>ossec</decoded>
        <match>rizin</match>
        <match>pyc</match>
        <description>CVE-2022-36040: Rizin execution with PYC file argument - potential exploitation of out-of-bounds write vulnerability</description>
        <group>local_policy,</group>
        <mitre>
            <id>T1203</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source

Immediate Mitigations (no patch available)

1. Avoid opening untrusted PYC files: Treat any Python-compiled bytecode from unknown origins as malicious. Do not load PYC files in Rizin unless their provenance is verified.
2. Sandbox execution: Run Rizin in an isolated environment (separate VM, Docker container, or sandboxed workspace) when analyzing untrusted binaries. This contains potential exploitation and limits the blast radius.
3. Disable PYC parsing: If Rizin usage does not require Python bytecode analysis, configure the tool to reject PYC files. Modification of file association settings or Rizin's configuration to prevent loading of .pyc extensions will reduce attack surface.
4. Use static file analysis first: Before opening a PYC file with Rizin, inspect it using a hex editor or file utility (e.g., file command) to identify anomalies. Look for oversized headers or malformed structural elements.
5. Apply filesystem controls: Deploy endpoint detection and response (EDR) rules on Linux/Windows to monitor Rizin binary execution and block file-open operations from non-standard directories.

Patch/Upgrade Steps

1. Monitor for patched release: The patch commit 68948017423a12786704e54227b8b2f918c2fd27 addresses the vulnerability. Until a versioned release (e.g., 0.5.0) containing this fix is published, users should watch Rizin's GitHub releases at https://github.com/rizinorg/rizin/releases.
2. Manual patching (for source-build users): Update your source tree by fetching the patch commit: git cherry-pick 68948017423a12786704e54227b8b2f918c2fd27, then rebuild and re-install.
3. Package manager updates: Once a patched version is available in your distribution's repository (Debian, Homebrew, Arch, etc.), apply the update immediately.
4. Track advisories: Subscribe to Rizin's security notifications via GitHub Security Advisories to stay informed of patch releases.

Long-Term Hardening

1. Adopt memory-safe analysis tools: Where feasible, consider transitioning to complementary tools or using Rizin in conjunction with external sandboxes that isolate file parsing.
2. Develop internal PYC parsing policy: Document a standard operating procedure for handling Python bytecode that includes mandatory scanning and validation steps before analysis.
3. Harden the workflow: Implement the principle of least privilege — run Rizin under a restricted, non-administrative account with limited file system access (e.g., dedicated analysis VM without network connectivity).
4. Regular vulnerability scanning: Incorporate Rizin into your organization's software vulnerability management program to ensure timely detection of future patches.
5. Security awareness training: Educate analysts on the risks of processing untrusted binary files and the specific risks associated with CVE-2022-36040.

Note on CISA KEV: This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. No active exploitation campaigns in the wild have been identified to date, although silent exploitation is possible given the vulnerability's recency.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-36040 — Official CVE record with NVD description and CVSS vector.
2. GitHub Commit (Patch): https://github.com/rizinorg/rizin/commit/68948017423a12786704e54227b8b2f918c2fd27 — The commit containing the fix for the out-of-bounds write in pyc/marshal.c.
3. Rizin Security Advisory: https://github.com/rizinorg/rizin/security/advisories — Monitor for the official advisory correlating to commit 6894801; advisory may not yet be published.
4. Rizin GitHub Repository: https://github.com/rizinorg/rizin — Main repository for version release tracking and security discussions.
5. CWE-787 Reference: https://cwe.mitre.org/data/definitions/787.html — Out-of-bounds Write weakness description and exploitation vectors.

No known threat actor campaigns or exploit-in-the-wild evidence have been documented for this CVE as of the report date. Exploitation likelihood is currently low (EPSS 0.00364).