提交 #953395: JusticeRage Manalyze 0.9 Integer Underflow信息

标题JusticeRage Manalyze 0.9 Integer Underflow
描述Manalyze contains an integer underflow in PE::_parse_relocations() when parsing IMAGE_BASE_RELOCATION blocks. The attacker-controlled reloc->BlockSize field is used in the calculation: (reloc->BlockSize - header_size) / sizeof(uint16_t) where header_size is 8 bytes. The parser validates that BlockSize is not greater than the remaining relocation directory size, but does not reject values smaller than the 8-byte relocation block header before performing the subtraction. When BlockSize is in the range 1-7, the unsigned subtraction underflows. For example, with BlockSize=4: (4 - 8) = 0xFFFFFFFC After division by sizeof(uint16_t), this produces a loop bound of 0x7FFFFFFE (2,147,483,646) iterations. The loop subsequently performs fread() operations and pushes the resulting uint16_t values into a std::vector without terminating when EOF is reached, causing the vector to grow excessively and potentially exhaust available memory. A crafted PE file with BlockSize=4 was used to reproduce the issue. A 50 MB PoC caused the parser to allocate approximately 50 MB for the relocation vector. Larger crafted files can cause correspondingly larger memory consumption and may result in an out-of-memory condition and denial of service. This issue affects applications and services that process untrusted PE files using the Manalyze/manape parser, including automated malware analysis, scanning and CI/CD workflows. Affected component: manape / PE parser Affected function: PE::_parse_relocations() Affected structure: IMAGE_BASE_RELOCATION Trigger condition: IMAGE_BASE_RELOCATION.BlockSize < 8 Impact: Denial of Service through excessive memory consumption / resource exhaustion. The issue was subsequently addressed upstream by adding validation that rejects relocation blocks smaller than the required header size and validates the relocation entry size. Fix: https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0
来源⚠️ https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0
用户
 akbarov (UID 100866)
提交2026-08-30 13時38分 (23 日前)
管理2026-09-22 19時33分 (23 days later)
状态已接受
VulDB条目408568 [JusticeRage Manalyze 1.0.0 PE Parser manape/pe.cpp PE::_parse_relocations BlockSize 内存损坏]
积分20

Want to know what is going to be exploited?

We predict KEV entries!