CVE-2022-34502: 
NixOS vulnerability analysis and mitigation

Radare2 version 5.7.0 was discovered to contain a heap buffer overflow vulnerability in the consume_encoded_name_new function located in format/wasm/wasm.c. This vulnerability was assigned CVE-2022-34502 and was disclosed in July 2022 (NVD, MITRE).

The vulnerability exists in the WASM name handling functionality of Radare2. Specifically, the issue occurs in the consume_encoded_name_new function within format/wasm/wasm.c, where a heap buffer overflow can be triggered when processing crafted binary files. The vulnerability was confirmed using AddressSanitizer, which detected a write operation beyond the allocated buffer boundaries (GitHub Issue).

This vulnerability allows attackers to cause a Denial of Service (DoS) by crafting specific binary files that trigger the heap buffer overflow. When exploited, the vulnerability can lead to program crashes and potential service disruption (NVD).

The vulnerability can be triggered by opening a specially crafted binary file with Radare2. A proof of concept exists demonstrating the exploitation using a file of just 38 bytes, which when processed by Radare2 5.7.0, triggers a heap-buffer-overflow at a specific memory address (GitHub Issue).

The vulnerability was patched in version 5.7.8. Users are recommended to upgrade to this version or later to address the security issue (OpenSUSE Build).