| 标题 | JusticeRage Manalyze 0.9 Integer Underflow |
|---|
| 描述 | Manalyze contains an integer underflow in PE::_parse_relocations() when parsing IMAGE_BASE_RELOCATION blocks.
The attacker-controlled reloc->BlockSize field is used in the calculation:
(reloc->BlockSize - header_size) / sizeof(uint16_t)
where header_size is 8 bytes.
The parser validates that BlockSize is not greater than the remaining relocation directory size, but does not reject values smaller than the 8-byte relocation block header before performing the subtraction.
When BlockSize is in the range 1-7, the unsigned subtraction underflows. For example, with BlockSize=4:
(4 - 8) = 0xFFFFFFFC
After division by sizeof(uint16_t), this produces a loop bound of 0x7FFFFFFE (2,147,483,646) iterations.
The loop subsequently performs fread() operations and pushes the resulting uint16_t values into a std::vector without terminating when EOF is reached, causing the vector to grow excessively and potentially exhaust available memory.
A crafted PE file with BlockSize=4 was used to reproduce the issue. A 50 MB PoC caused the parser to allocate approximately 50 MB for the relocation vector. Larger crafted files can cause correspondingly larger memory consumption and may result in an out-of-memory condition and denial of service.
This issue affects applications and services that process untrusted PE files using the Manalyze/manape parser, including automated malware analysis, scanning and CI/CD workflows.
Affected component: manape / PE parser
Affected function: PE::_parse_relocations()
Affected structure: IMAGE_BASE_RELOCATION
Trigger condition: IMAGE_BASE_RELOCATION.BlockSize < 8
Impact: Denial of Service through excessive memory consumption / resource exhaustion.
The issue was subsequently addressed upstream by adding validation that rejects relocation blocks smaller than the required header size and validates the relocation entry size.
Fix:
https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0 |
|---|
| 来源 | ⚠️ https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0 |
|---|
| 用户 | akbarov (UID 100866) |
|---|
| 提交 | 2026-08-30 13時38分 (23 日前) |
|---|
| 管理 | 2026-09-22 19時33分 (23 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 408568 [JusticeRage Manalyze 1.0.0 PE Parser manape/pe.cpp PE::_parse_relocations BlockSize 内存损坏] |
|---|
| 积分 | 20 |
|---|