CVE-2021-32613: 
NixOS vulnerability analysis and mitigation

In radare2 through version 5.3.0, there is a double free vulnerability in the pyc parse functionality when processing a crafted file. The vulnerability was discovered in May 2021 and assigned identifier CVE-2021-32613. The issue affects the Python bytecode parsing component of radare2, a widely used reverse engineering framework (GitHub Issue, RedHat Bugzilla).

The vulnerability occurs in the pyc parse functionality when processing specially crafted Python bytecode files. The issue manifests as a double free condition in the memory management of parsed objects, which can be triggered when processing certain file structures. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Ubuntu Security).

When successfully exploited, this vulnerability can lead to a Denial of Service (DoS) condition in the affected system. The impact is primarily limited to availability, with no direct impact on confidentiality or integrity of the system (Ubuntu Security).

The vulnerability requires local access and user interaction to exploit, as it involves processing a specially crafted Python bytecode file. The attack complexity is considered low, and no special privileges are required to execute the exploit (Ubuntu Security).

The vulnerability was fixed in subsequent releases of radare2. Users are advised to upgrade to a version newer than 5.3.0. The fix was implemented through commits that address the double free condition in the pyc parser (GitHub Commit).

The vulnerability was acknowledged and addressed by various Linux distributions including Fedora, which released security updates to address the issue. Fedora provided updates for both version 33 and 34 of their distribution to patch this vulnerability (Fedora Update).