A vulnerability has been discovered in AFLplusplus, which can lead to arbitrary code execution via an untrusted CWD.

Announced

2024-08-11

Revised

2024-08-11

Access

local

Bugs

#897924

Advisory

https://security.gentoo.org/glsa/202408-27

Affected packages

Package	Arch	Vulnerable	Unaffected
app-forensics/aflplusplus	*	< 4.06c	>= 4.06c

Background

The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!

Description

In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution.

Impact

In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution.

Workaround

There is no known workaround at this time.

Resolution

All AFLplusplus users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-forensics/aflplusplus-4.06c"

References

• CVE-2023-26266