| タイトル | JusticeRage Manalyze 0.9 Integer Underflow |
|---|
| 説明 | Manalyze contains an integer underflow in PE::_parse_relocations() when parsing IMAGE_BASE_RELOCATION blocks.
The attacker-controlled reloc->BlockSize field is used in the calculation:
(reloc->BlockSize - header_size) / sizeof(uint16_t)
where header_size is 8 bytes.
The parser validates that BlockSize is not greater than the remaining relocation directory size, but does not reject values smaller than the 8-byte relocation block header before performing the subtraction.
When BlockSize is in the range 1-7, the unsigned subtraction underflows. For example, with BlockSize=4:
(4 - 8) = 0xFFFFFFFC
After division by sizeof(uint16_t), this produces a loop bound of 0x7FFFFFFE (2,147,483,646) iterations.
The loop subsequently performs fread() operations and pushes the resulting uint16_t values into a std::vector without terminating when EOF is reached, causing the vector to grow excessively and potentially exhaust available memory.
A crafted PE file with BlockSize=4 was used to reproduce the issue. A 50 MB PoC caused the parser to allocate approximately 50 MB for the relocation vector. Larger crafted files can cause correspondingly larger memory consumption and may result in an out-of-memory condition and denial of service.
This issue affects applications and services that process untrusted PE files using the Manalyze/manape parser, including automated malware analysis, scanning and CI/CD workflows.
Affected component: manape / PE parser
Affected function: PE::_parse_relocations()
Affected structure: IMAGE_BASE_RELOCATION
Trigger condition: IMAGE_BASE_RELOCATION.BlockSize < 8
Impact: Denial of Service through excessive memory consumption / resource exhaustion.
The issue was subsequently addressed upstream by adding validation that rejects relocation blocks smaller than the required header size and validates the relocation entry size.
Fix:
https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0 |
|---|
| ソース | ⚠️ https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0 |
|---|
| ユーザー | akbarov (UID 100866) |
|---|
| 送信 | 2026年08月30日 13:38 (23 日 ago) |
|---|
| モデレーション | 2026年09月22日 19:33 (23 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 408568 [JusticeRage Manalyze 1.0.0 PE Parser manape/pe.cpp PE::_parse_relocations BlockSize メモリ破損] |
|---|
| ポイント | 20 |
|---|