Use-After-Free in pybddisasm Python Bindings

Executive Summary

This is a use-after-free vulnerability in the pybddisasm Python library. It affects array-valued members of INSTRUX objects, which are exposed as Python lists. These lists reference memory owned by the parent object. If the parent object is freed but the list or its elements are retained and accessed later, it leads to accessing freed memory. This can cause the Python process to crash or expose process memory.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to applications using the pybddisasm Python library. Detection requires checking for applications that use pybddisasm and inspecting their code for improper handling of INSTRUX objects or ND_OPERAND arrays. No direct network detection commands are applicable.

Useful 0 Not Useful 0

Impact Analysis

The impact includes potential crashes of the Python process using pybddisasm. It may also expose sensitive process memory, which could lead to information disclosure or further exploitation depending on the application context. Exploitation requires retaining and accessing array elements after the parent object is freed.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately stop using the pybddisasm package as it is no longer maintained. Replace it with an actively maintained alternative for binary disassembly tasks. Audit all applications using pybddisasm to ensure proper memory management of INSTRUX objects and their arrays.

Useful 0 Not Useful 0