Libriscv
Monthly
Out-of-bounds reads in libriscv's ELF parser, affecting versions through 1.17, let a crafted RISC-V ELF crash the host emulator (rvlinux) and, under favourable heap layout, may map out-of-buffer host heap memory into the guest. The flaw sits in section-header handling: sh_offset/sh_size for .text and .symtab are trusted and used to index the binary buffer without a range check, bypassing the PT_LOAD validation performed during loading. The GitHub advisory publishes a PoC script that overwrites the .text/.symtab offsets with 0x7FFFFFFFF0000000 and reproduces a host SIGSEGV; host memory disclosure is described as possible through grooming or integer overflow rather than demonstrated. Assessed CVSS is 7.9 (AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H) - no privileges required on the CVSS vector, but the attack requires getting a binary into the emulator, and there is no KEV listing or confirmed in-the-wild exploitation.
Out-of-bounds reads in libriscv's ELF parser, affecting versions through 1.17, let a crafted RISC-V ELF crash the host emulator (rvlinux) and, under favourable heap layout, may map out-of-buffer host heap memory into the guest. The flaw sits in section-header handling: sh_offset/sh_size for .text and .symtab are trusted and used to index the binary buffer without a range check, bypassing the PT_LOAD validation performed during loading. The GitHub advisory publishes a PoC script that overwrites the .text/.symtab offsets with 0x7FFFFFFFF0000000 and reproduces a host SIGSEGV; host memory disclosure is described as possible through grooming or integer overflow rather than demonstrated. Assessed CVSS is 7.9 (AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H) - no privileges required on the CVSS vector, but the attack requires getting a binary into the emulator, and there is no KEV listing or confirmed in-the-wild exploitation.