CVE-2024-11858

What it actually does

Command injection in Radare2 caused by insufficient input validation when parsing Pebble Application files, allowing injected shell commands to execute during file processing.

Why it matters to the business

Attackers can gain unauthorized command execution on developer or analyst systems that open malicious files, risking data theft or further compromise; low EPSS and no KEV status indicate limited current threat but patching remains necessary for affected environments.

How an attack unfolds

An attacker creates a specially crafted Pebble Application file containing shell metacharacters. When a victim opens the file with Radare2, the command parser fails to sanitize input and executes the injected commands during processing.

How to fix it

Upgrade affected packages to the listed fixed versions: wireshark on Ubuntu 14.04 to 1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.1 and on Ubuntu 16.04 to 2.2.6+g32dac6a-2ubuntu0.16.04; apply vendor patches or rebuild from source after input validation hardening.

How to confirm the fix worked

Confirm package versions match the fixed releases, test parsing of sample Pebble files for command execution attempts, and review build logs or package manifests for the updated binaries.

Typical attack path

1. Craft malicious Pebble Application file with embedded shell commands
2. Deliver file via email, download, or repository
3. Victim opens file in Radare2
4. Insufficient validation triggers command execution during parsing
5. Attacker achieves code execution on the host

How to detect it

Search process execution logs, shell history, and file access records for unexpected command invocations tied to file open events involving Pebble Application files or radare2 processes.

What your security team should do

• Apply the specified fixed package versions immediately on all Ubuntu 14.04 and 16.04 systems running wireshark or Radare2
• Restrict opening of untrusted Pebble Application files until patched
• Monitor EPSS trend for increases and watch for new exploit code
• Update file-handling policies and add sandboxing for reverse-engineering tools