Stack-Based Out-of-Bounds Write in Ghidra Decompiler

Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability located in the decompiler's leftshift128 function. This vulnerability is triggered when the decompiler processes p-code containing negative shift amounts. An attacker can exploit this by providing a specially crafted binary containing specific instruction sequences. When a user opens or performs analysis on this malicious binary within Ghidra, the decompiler's memory becomes corrupted during the calculation process. This memory corruption can lead to the execution of arbitrary code with the privileges of the user running the Ghidra application. This is particularly relevant for security researchers and reverse engineers who frequently analyze untrusted binaries.

Impact

The vulnerability poses a significant risk to the security research community and software analysts who use Ghidra for reverse engineering tasks. If exploited, an attacker could gain control over the analyst's machine, potentially leading to the theft of sensitive project data, intellectual property, or further lateral movement within an organization's network.

Recommendation

Prioritized, concrete actions for security teams:

• Identify and inventory all instances of Ghidra 12.1.4 or earlier within the development and research environments.
• Upgrade all instances of Ghidra to the latest patched version available from the official National Security Agency repository.
• Implement a policy to sandbox reverse engineering tools, including Ghidra, to minimize the impact of potential arbitrary code execution vulnerabilities.
• Alert users who frequently analyze third-party or untrusted binaries to be cautious when importing unknown files into the Ghidra environment until patches are applied.