CVE-2023-27590

Executive Summary

CVE-2023-27590 is a stack-based buffer overflow vulnerability in Rizin, a UNIX-like reverse engineering framework and command-line toolset. Versions 0.5.1 and prior are affected when converting a GDB registers profile file into a Rizin register profile, specifically when the name, type, or groups fields exceed expected length limits. The flaw is triggered when a user opens an untrusted GDB registers file via the drpg or arpg commands, potentially leading to arbitrary code execution in the context of the Rizin process. Successful exploitation could result in full system compromise of the analyst's workstation, making this a significant supply-chain and malware-analysis risk for security teams and reverse engineers.

Technical Analysis

Rizin is a reverse engineering framework that provides binary analysis, debugging, and disassembly capabilities. As part of its functionality, Rizin can import GDB register profile files to map register definitions, types, and grouping information into its own internal representation. The conversion process from GDB's register profile format to Rizin's register profile format is performed when users invoke the drpg (debug register profile from GDB) or arpg (analysis register profile from GDB) commands.

The vulnerability resides in the parsing/conversion routine that handles the GDB register profile file format. When the parser extracts the name, type, or groups fields from the input file, it copies these values into fixed-size stack buffers without adequate bounds checking. If any of these fields contain more characters than the buffer can accommodate, the excess data overflows into adjacent stack memory, corrupting the call stack and potentially overwriting saved return addresses or other critical control-flow data.

The attack surface is the local file parsing functionality. An attacker would need to deliver a maliciously crafted GDB registers profile file to the victim and convince them to load it through the drpg or arpg command. This is realistic in security research contexts where analysts routinely process untrusted binaries and associated metadata files from unverified sources, or when malware samples are distributed with accompanying register profile files that are used during analysis.

The CNA title explicitly confirms this is a stack-based buffer overflow ("Rizin has stack-based buffer overflow when parsing GDB registers profile files"). The NVD description states that the overflow occurs "when the name, type, or groups fields have longer values than expected," confirming that the vulnerability is in the field-length validation logic of the parser.

The patch reference is commit d6196703d89c84467b600ba2692534579dc25ed4, though the patch confidence is 0/4 from tracked sources, meaning the existence and efficacy of this patch could not be verified by the tracking systems. This discrepancy suggests that the patch may not be publicly released, not merged into a stable branch, or referenced under a different identifier.

Stack-based buffer overflows of this nature typically allow an attacker to overwrite the saved instruction pointer (EIP/RIP) on the stack, redirecting execution to attacker-controlled data. On modern systems with protections such as ASLR, DEP, and stack canaries, exploitation may require additional information leak steps or the use of return-oriented programming (ROP) chains, but the severity remains high given the local execution context and the trust users place in analysis tools.

Exploitation Scenarios

Stage 1 — Reconnaissance and Target Identification: The attacker identifies a target who is actively using Rizin for reverse engineering, malware analysis, or vulnerability research. This could be determined through public forums, GitHub activity, conference talks, or job postings. The attacker needs no network access to a service — the attack vector is entirely local, relying on social engineering or supply-chain infiltration to deliver the malicious file.

Stage 2 — Malicious File Crafting and Delivery: The attacker crafts a GDB registers profile file (typically with a .gdb or similar extension) containing oversized values in the name, type, or groups fields. These fields will contain carefully calculated byte sequences designed to overwrite stack metadata — specifically the saved return address — with a pointer to attacker-controlled shellcode or a ROP chain. The file is then distributed through likely channels: a GitHub repository, a forum attachment, a shared analysis workspace, or bundled with a malware sample that the target is expected to analyze. Social engineering may be minimal since analysts routinely accept such auxiliary files from third parties during research collaborations.

Stage 3 — Triggering the Overflow: The victim opens the malicious GDB registers file within Rizin using either the drpg or arpg command. Since these commands are explicitly mentioned in the NVD description, they are the only confirmed trigger points. The attacker does not need to rely on any configuration outside of the normal Rizin workflow — the victim is expected to run these commands as part of standard analysis when working with a GDB register profile. At the moment the parser reads the oversized field and copies it into the stack buffer, the overflow occurs, overwriting adjacent stack memory including the saved return address. When the parsing function returns, execution is redirected to the attacker's injected payload.

Stage 4 — Post-Exploitation: Once code execution is achieved within the Rizin process, the attacker's payload runs with the privileges of the Rizin user — typically the analyst's account. The payload could spawn a reverse shell, install a keylogger, exfiltrate sensitive analysis data (including disassembly of proprietary binaries or details of undisclosed vulnerabilities), install persistence mechanisms, or pivot to other systems on the network. Since reverse engineering workstations often contain highly sensitive data — including unreleased software, vulnerability research, and credentials for development environments — the impact of a compromise is disproportionate to the apparent simplicity of the attack.

No public PoC is available for this CVE; the attack chain described above is inferred from the vulnerability class and the confirmed trigger conditions in the NVD description. Specific exploit payload structure, exact overwrite offsets, and evasion techniques cannot be detailed further without additional technical information.

Impact Assessment

CVSS Score: 7.8 (High) — The scoring reflects local attack vector (AV:L), low attack complexity (AC:L), no privilege requirements (PR:N), and required user interaction (UI:R). The impact is rated high across confidentiality, integrity, and availability (C:H/I:H/A:H), reflecting full code execution capability.

Business Impact: For organizations employing reverse engineering teams — such as security vendors, government agencies, defense contractors, and software companies — a compromise of an analyst's Rizin environment represents a severe insider threat scenario. The attacker gains access to pre-publication research, potentially including zero-day vulnerabilities, proprietary protocol internals, and malware analysis intelligence. This can directly translate to a loss of competitive advantage, disclosure of trade secrets, or early warning of vulnerability research being exploited in the wild.

Affected Systems: All Rizin installations running version 0.5.1 or earlier. This includes Linux, macOS, and other UNIX-like operating systems where Rizin is deployed. The tool is widely used in malware analysis labs and security research departments, making the affected population highly specialized but of elevated sensitivity.

Blast Radius: The immediate blast radius is the compromised analyst workstation. However, since reverse engineering workstations are typically connected to internal vulnerability-database servers, malware repository sandboxes, and continuous-integration pipelines for security tooling, an attacker with code execution on such a system can expand laterally. The EPSS score of 0.00315 (24.0% percentile) indicates low current exploitation likelihood, but this does not account for targeted attacks against high-value research organizations.

Availability Impact: A failed exploit attempt or a crash caused by the buffer overflow would terminate the Rizin process. In automated analysis pipelines that depend on Rizin for batch processing, this could result in denial of service and interruption of time-sensitive malware analysis workflows.

Detection Guidance

Sigma Rule

title: Rizin GDB Register Profile Buffer Overflow Attempt
id: c30f1aae-9e39-4b5c-9a77-fc9ef9d8a2b1
status: experimental
description: Detects attempts to exploit CVE-2023-27590 by monitoring for Rizin processes loading GDB register profile files with abnormally long field values.
author: Valtersit Threat Intelligence
logsource:
    category: process_creation
    product: linux
detection:
    selection_rizin:
        Image|endswith:
            - '/rizin'
            - '/rz-bin'
        CommandLine|contains:
            - 'drpg'
            - 'arpg'
    selection_gdb_file:
        CommandLine|endswith:
            - '.gdb'
            - '.gdbprofile'
    condition: selection_rizin and selection_gdb_file
    timeframe: 1m
level: high
falsepositives:
    - Legitimate use of GDB register profiles in authorized reverse engineering work
    - Internal research files with long but benign field names
tags:
    - attack.t1203
    - cve.2023-27590

YARA Rule

rule CVE_2023_27590_Rizin_GDB_Profile
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects GDB register profile files with oversized name, type, or groups fields targeting CVE-2023-27590"
        cve = "CVE-2023-27590"
        date = "2024-01-01"
        severity = "high"

    strings:
        $name_field = "name" ascii nocase
        $type_field = "type" ascii nocase
        $groups_field = "groups" ascii nocase
        $reg_field = "reg" ascii nocase

    condition:
        (filesize > 1KB and filesize < 1MB) and
        any of ($name_field, $type_field, $groups_field) and
        $reg_field and
        # oversized field detection: look for lines with field values exceeding 256 bytes
        for any i in (0..10) : (
            @name_field[i] and (
                uint32(@name_field[i] - 1) > 256 or
                uint32(@type_field[i] - 1) > 256 or
                uint32(@groups_field[i] - 1) > 256
            )
        )
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2023-27590 Rizin GDB Register Profile Transfer Attempt"; content:"drpg"; nocase; content:".gdb"; nocase; content:"name"; content:"type"; content:"groups"; pcre:"/(name|type|groups)\s*=\s*.{257,}/i"; classtype:attempted-user; sid:202327590; rev:1; metadata:created_at 2024_01_01, cve CVE-2023-27590;)

Note: This Suricata rule detects network transfers of malicious GDB profile files, since the exploit itself is triggered locally. Detection of the local trigger is better served by endpoint monitoring rules (Sigma, Wazuh, Elastic), while this rule focuses on the delivery mechanism over network channels.

Elastic Detection

// Elastic EQL rule for detecting Rizin processes with GDB profile loading
sequence by process.pid
  [process where event.type == "start" and
   process.name in ("rizin", "rz-bin") and
   process.command_line like "*drpg*" or process.command_line like "*arpg*"]
  [file where event.type == "creation" and
   file.extension in ("gdb", "gdbprofile") and
   file.size > 1024]

Splunk SPL Query

index=endpoint sourcetype=ProcessRollup2
| search (CommandLine="*drpg*" OR CommandLine="*arpg*") AND (CommandLine="*.gdb*")
| stats count by host, user, ProcessName, CommandLine, _time
| sort - _time
| table _time, host, user, ProcessName, CommandLine, count
| where count > 1

Wazuh OSSEC Rule

<group name="rizin,">
  <rule id="100275" level="12">
    <if_sid>500</if_sid>
    <match>drpg|arpg</match>
    <regex>\.gdb</regex>
    <description>Rizin process loading GDB register profile - potential CVE-2023-27590 exploitation</description>
    <group>cve_2023_27590</group>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment: The patch confidence is rated 0/4, meaning the vendor fix status is UNPATCHED from the perspective of tracked sources. Although the NVD description references a specific commit (d6196703d89c84467b600ba2692534579dc25ed4), this reference could not be validated by the tracking infrastructure. This may be due to the commit not yet being merged into a public release branch, being a private commit, or the tracking sources being out of sync with the Rizin project repository.

1. Immediate Mitigations (apply now):

• Do NOT open GDB register profile files from untrusted or unverified sources in Rizin versions 0.5.1 or earlier.
• Review and manually validate any GDB register profile files before loading them with drpg/arpg, as suggested in the NVD description workaround. Check that name, type, and groups fields contain only expected short values (typically under 64 characters in legitimate profiles).
• If Rizin is used in an automated analysis pipeline, add a pre-processing validation step that rejects GDB register profile files with any field exceeding 64 characters.
• Consider replacing Rizin's GDB profile import functionality with a manual register configuration approach until a verified fix is available.

2. Patch/Upgrade Steps:

• Monitor the official Rizin GitHub repository (https://github.com/rizinorg/rizin) for release announcements containing commit d6196703d89c84467b600ba2692534579dc25ed4 or subsequent releases addressing this issue.
• When a patched version (expected 0.5.2 or later) is released, upgrade all Rizin installations immediately.
• Verify the patch by testing that intentionally malformed GDB profile files fail gracefully without crashing or corrupting the stack.
• If direct CVEs are embedded in Linux distribution packages, track the package manager advisory channels (e.g., Debian Security Tracker, Ubuntu CVE Tracker) for backported fixes.

3. Long-Term Hardening:

• Run Rizin in a sandboxed environment (e.g., gVisor, Firecracker, or a dedicated VM) especially when processing untrusted analysis inputs such as GDB profile files from external collaborators.
• Apply strict file integrity monitoring on GDB profile file directories to detect unauthorized modifications to analysis inputs.
• Implement a security awareness workflow within your reverse engineering team: require internal validation and signing of any auxiliary analysis files before distribution within the organization.
• Monitor CISA KEV and vendor advisories for updates, as the vulnerability could be re-scored or re-evaluated if exploitation in the wild is confirmed.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-27590
2. Rizin Official Repository: https://github.com/rizinorg/rizin
3. CNA Patch Reference (mentioned in NVD): Commit d6196703d89c84467b600ba2692534579dc25ed4
4. Rizin Project Website: https://rizin.re/
5. CISA KEV (Not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns: No known threat actor campaigns or exploits-in-the-wild evidence for CVE-2023-27590 have been identified at the time of writing. The EPSS score of 0.00315 places this CVE in the 24.0% percentile of exploited CVEs, indicating a low (but non-zero) probability of exploitation in the wild. This may increase if the vulnerability is discovered to be leveraged in targeted supply-chain attacks against security research firms, given the high-value intellectual property present in reverse engineering environments. Continuous monitoring of exploit-database aggregators and security research community discussions is recommended.