CVE-2024-48241

What it actually does

A local attacker can invoke the __bf_div function in radare2 versions 5.8.0 through 5.9.4 to trigger a denial of service, resulting in application crash or unresponsiveness.

Why it matters to the business

Disrupts binary analysis and reverse engineering workflows on affected systems, causing operational downtime for security teams and developers until the process is restarted.

How an attack unfolds

An attacker with local access supplies crafted input or commands to radare2 that reach the vulnerable __bf_div function, causing the tool to terminate unexpectedly.

How to fix it

Upgrade radare2 to a version newer than 5.9.4. Apply the listed fixed package versions where applicable for the affected products.

How to confirm the fix worked

Verify the installed radare2 version is outside 5.8.0-5.9.4 range; attempt to reproduce the DoS condition with known triggering inputs to confirm resolution.

Typical attack path

1. Obtain local access to a system running vulnerable radare2
2. Launch radare2 with input designed to reach __bf_div
3. Trigger the function to induce crash or hang

How to detect it

Review system and application logs for radare2 process terminations or segmentation faults around the time of suspected local activity; inspect command-line arguments or input files that may invoke __bf_div.

What your security team should do

• Prioritize upgrading radare2 on all instances to a fixed release
• Limit local execution privileges for radare2 where feasible
• Monitor for repeated process crashes in analysis environments