CVE-2018-19974

low-risk

Published 2018-12-17

In YARA 3.8.1, bytecode in a specially crafted compiled rule can read uninitialized data from VM scratch memory in libyara/exec.c. This can allow attackers to discover addresses in the real stack (not the YARA virtual stack).

Do I need to act?

0.25% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Yara

Affected Vendors

Virustotal

References (8)

Exploit https://bnbdr.github.io/posts/extracheese/

Exploit https://github.com/VirusTotal/yara/issues/999

Exploit https://github.com/bnbdr/swisscheese/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Exploit https://bnbdr.github.io/posts/extracheese/

Exploit https://github.com/VirusTotal/yara/issues/999

Exploit https://github.com/bnbdr/swisscheese/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal