CVE-2021-4407 reference

gistfile1.txt

[Vulnerability Type Other]
  CWE-697: Incorrect Comparison

[Vendor of Product]
  unicorn-engine

[Affected Product Code Base]
  unicorn engine - <=2.0.0

[Affected Component]
  uc.c, split_region

[Attack Type]
  Local

[Impact Code execution]
  true

[Attack Vectors]
  run specially crafted code withing unicorn with uc_mem_map_ptr() and uc_mem_unmap() supported

[Description]
  An issue was discovered in split_region in uc.c in Unicorn Engine through 1.0.3 and 2.x through 2.0.0-rc4.
  It allows local attackers to escape the sandbox.
  An attacker must first
  obtain the ability to execute crafted code in the target
  sandbox in order to exploit this vulnerability. The specific flaw
  exists within the virtual memory manager. The issue results from the
  faulty comparison of GVA and GPA while calling uc_mem_map_ptr to free
  part of a claimed memory block. An attacker can leverage this
  vulnerability to escape the sandbox and execute arbitrary code on the host
  machine.

[Discoverer]
  jwang@Balsn

[Reference]
  Fix Patch : https://github.com/unicorn-engine/unicorn/commit/c733bbada356b0373fa8aa72c044574bb855fd24#diff-f978cc716461a0e6511a9a54b7931a714240e15fdc97ca002f75d36bda3af915
  Detailed Analysis : https://github.com/jwang-a/CTF/blob/master/MyChallenges/Pwn/Unicorns_Aisle/UnicornsAisle.pdf