Halibut 1.2 Memory Corruption Vulnerability Analysis (CVE-2021-42006)

Critical Vulnerability Information Research Background Research Focus: Investigation of memory corruption vulnerabilities in Linux C/C++ programs, with development of the ARCUS framework for automated analysis. Achievements: Discovery of vulnerabilities such as CVE-2021-42006, and academic papers published at USENIX Security Symposium and forthcoming at ACM CCS. Environment Information Tested Program: Halibut version 1.2 Execution Environment: Debian Bullseye and Ubuntu Hirsute, x86-64 architecture Vulnerability Details 1. Double Free in in - Reproduction Steps: - Download PoC - Run - Core Issue: Exhibits error 2. Use-After-Free in in - Reproduction Steps: - Download PoC - Run - Core Issue: Although located in the same code region as the above vulnerability, it triggers a segmentation fault due to recursive deallocation, rather than a double-free error. 3. Use-After-Free in in - Reproduction Steps: - Download PoC - Run - Core Issue: issue within Root Cause Analysis Analysis via ARCUS identifies that improper operations in the function lead to memory issues: - Line 416: is called inappropriately. - Line 469: is directly freed after handling bracket characters, causing potential memory corruption. Additional problematic lines exist but are not detailed here. --- The discovery and analysis of these three vulnerabilities validate the effectiveness of the ARCUS framework and underscore the critical importance of memory safety in software engineering.

Goal Reached Thanks to every supporter — we hit 100%!

Halibut 1.2 Memory Corruption Vulnerability Analysis (CVE-2021-42006)