Vulnerability feed

Executive summary

The advisory says Ghidra versions before 12.2 contain a numeric truncation flaw in its packed-data decoder, in the marshal.cc file. The advisory text does not state how severe the flaw is, and it does not give a CVSS score or describe any fix beyond the version boundary.

Technical summary

The flaw is described as a numeric truncation bug in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc, where 64-bit string lengths are stored in a narrower integer. The provided text shows the code, where readInteger returns a uint8 but skipAttribute and skipAttributeRemaining store the result in a uint4 length variable, which could cause incorrect skipping of data. The advisory text is cut off before its full description, so the attack vector, required preconditions, and exploitation status are not stated. The affected range is stated as before 12.2, but a fixed version number, workaround, and detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/NationalSecurityAgency/ghidr…marshal.cc#L641-L671

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Attack requirements

Present

Privileges required

None

User interaction

Passive

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

NationalSecurityAgencyGhidraNationalSecurityAgency ghidraGhidra