| 제목 | JusticeRage Manalyze 0.9 Integer Underflow |
|---|
| 설명 | Manalyze contains an integer underflow in PE::_parse_relocations() when parsing IMAGE_BASE_RELOCATION blocks.
The attacker-controlled reloc->BlockSize field is used in the calculation:
(reloc->BlockSize - header_size) / sizeof(uint16_t)
where header_size is 8 bytes.
The parser validates that BlockSize is not greater than the remaining relocation directory size, but does not reject values smaller than the 8-byte relocation block header before performing the subtraction.
When BlockSize is in the range 1-7, the unsigned subtraction underflows. For example, with BlockSize=4:
(4 - 8) = 0xFFFFFFFC
After division by sizeof(uint16_t), this produces a loop bound of 0x7FFFFFFE (2,147,483,646) iterations.
The loop subsequently performs fread() operations and pushes the resulting uint16_t values into a std::vector without terminating when EOF is reached, causing the vector to grow excessively and potentially exhaust available memory.
A crafted PE file with BlockSize=4 was used to reproduce the issue. A 50 MB PoC caused the parser to allocate approximately 50 MB for the relocation vector. Larger crafted files can cause correspondingly larger memory consumption and may result in an out-of-memory condition and denial of service.
This issue affects applications and services that process untrusted PE files using the Manalyze/manape parser, including automated malware analysis, scanning and CI/CD workflows.
Affected component: manape / PE parser
Affected function: PE::_parse_relocations()
Affected structure: IMAGE_BASE_RELOCATION
Trigger condition: IMAGE_BASE_RELOCATION.BlockSize < 8
Impact: Denial of Service through excessive memory consumption / resource exhaustion.
The issue was subsequently addressed upstream by adding validation that rejects relocation blocks smaller than the required header size and validates the relocation entry size.
Fix:
https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0 |
|---|
| 원천 | ⚠️ https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0 |
|---|
| 사용자 | akbarov (UID 100866) |
|---|
| 제출 | 2026. 08. 30. PM 01:38 (24 날 ago) |
|---|
| 모더레이션 | 2026. 09. 22. PM 07:33 (23 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 408568 [JusticeRage Manalyze 1.0.0 PE Parser manape/pe.cpp PE::_parse_relocations BlockSize 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|