CVE-2024-26475

Executive Summary

CVE-2024-26475 is a denial-of-service (DoS) vulnerability in radare2, a popular open-source reverse engineering framework. The flaw resides in the grub_sfs_read_extent function, affecting versions 0.9.7 through 5.8.6. A local attacker can exploit this to cause a crash or hang, leading to service unavailability. The vulnerability has been patched in version 5.8.8. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. This report provides a comprehensive technical analysis, detection guidance, and remediation steps.

Supply Chain & Package Security

radare2 is distributed via multiple package managers and source repositories. Users should verify they are using the latest patched version (5.8.8 or later) from official sources. The vulnerability does not directly affect the supply chain of other packages, but organizations using radare2 in automated pipelines should ensure their deployments are updated.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Impact: Availability (C:N/I:N/A:H)
• Threat Level: Low (due to local attack vector and no public exploit)

Deep Dive & Mechanics

The vulnerability is a NULL pointer dereference (CWE-476) in the grub_sfs_read_extent function within radare2's SFS (SquashFS) file system parser. When processing a specially crafted SFS file, the function fails to properly validate a pointer before dereferencing it, leading to a segmentation fault or infinite loop. This causes the radare2 process to crash or hang, resulting in a denial of service.

The affected code path is triggered when radare2 attempts to read an extent (a block of data) from a SquashFS image. An attacker can craft a malicious SFS file that, when opened by a victim using radare2, triggers the vulnerability. Since the attack requires local access to the system and the ability to present a malicious file, the risk is limited to scenarios where untrusted users can execute radare2 on shared systems or where automated tools ingest untrusted SFS files.

Vulnerable vs. Patched Code

The vulnerable code in grub_sfs_read_extent (prior to v5.8.8) likely lacked a NULL check on a pointer returned from a memory allocation or data parsing function. The patched version (v5.8.8) adds proper validation before dereferencing.

Vulnerable (simplified):

void grub_sfs_read_extent(grub_sfs_data_t data, int extent_index) {
    grub_sfs_extent_t *extent = &data->extents[extent_index];
    // No NULL check on extent
    void *buffer = malloc(extent->size);
    // ...
}

Patched (simplified):

void grub_sfs_read_extent(grub_sfs_data_t data, int extent_index) {
    if (extent_index >= data->num_extents) {
        // Handle error
        return;
    }
    grub_sfs_extent_t *extent = &data->extents[extent_index];
    if (extent == NULL) {
        // Handle NULL pointer
        return;
    }
    void *buffer = malloc(extent->size);
    // ...
}

Exploitation & Lab Setup

Red Team

No public exploit code is available. To simulate the vulnerability, create a malformed SquashFS file that triggers the NULL pointer dereference. Use a tool like mksquashfs to generate a valid SFS, then manually corrupt the extent table using a hex editor. The goal is to cause radare2 to crash when opening the file.

Lab Setup:

1. Install radare2 v5.8.6 (vulnerable) on a test system.
2. Create a malicious SFS file (e.g., malicious.sfs).
3. Run: r2 malicious.sfs
4. Observe crash or hang.

Blue Team

• Monitor for radare2 crashes or abnormal terminations.
• Use file integrity monitoring to detect creation of suspicious SFS files.
• Restrict execution of radare2 to trusted users only.
• Implement application whitelisting to prevent untrusted binaries.

Indicators of Compromise (IOCs)

• File Hashes: (None available; generate upon PoC creation)
• Process Anomalies: radare2 process crashes with SIGSEGV or hangs indefinitely.
• Network: No network indicators (local vulnerability).
• Logs: System logs showing radare2 segmentation faults (e.g., /var/log/syslog on Linux).

Detection Engineering

YARA Rule

rule CVE_2024_26475_radare2_SFS_DoS {
    meta:
        description = "Detects malformed SFS files targeting radare2 CVE-2024-26475"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-26475"
    strings:
        $sfs_magic = { 68 73 71 73 } // "hsqs" SquashFS magic
        $extent_null = { 00 00 00 00 00 00 00 00 } // Potential null extent
    condition:
        $sfs_magic at 0 and #extent_null > 5
}

Sigma Rule

title: Radare2 Crash via Malicious SFS File
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects radare2 crashes caused by CVE-2024-26475
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "radare2.*segfault"
        - "radare2.*SIGSEGV"
    condition: selection
falsepositives:
    - Legitimate radare2 crashes due to other bugs
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-26475 radare2 SFS DoS Attempt"; flow:to_server; content:"|68 73 71 73|"; depth:4; content:"|00 00 00 00|"; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade radare2 to version 5.8.8 or later.
2. Apply vendor patch if available from official repository.
3. Restrict local access to radare2 on shared systems.
4. Use file scanning to detect malformed SFS files before processing.
5. Monitor for crashes and investigate any radare2 segmentation faults.

Valters IT
DevSecOps & Cyber Threat Intelligence