LiveActive security incident?Get immediate response
CVE Record

CVE-2017-16357: In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versi...

In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c, as demonstrated by an invalid free. This error is due to improper sh_size validation when allocating memory.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2017-16357 is a memory corruption flaw reported in radare 2.0.1 when parsing ELF version information. In practical terms, a vulnerable analysis workstation could crash or behave unpredictably when handling a malformed ELF file. The public record does not provide CVSS, confirmed impact scope, or active exploitation evidence.

Executive priority

Treat this as a targeted tooling risk, not a broad enterprise emergency. Prioritize teams handling malware, firmware, reverse engineering, or untrusted Linux binaries. Urgency rises if analysts still use radare/radare2 2.0.1 or unsupported historical builds.

Technical view

The issue is in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c. The CVE description attributes the memory corruption, demonstrated as an invalid free, to improper sh_size validation during allocation. The affected-product metadata is incomplete, but the description identifies radare 2.0.1 and references radare2 issue and commit records.

Likely exposure

Exposure is most likely on systems where radare/radare2 2.0.1 is installed and used to inspect ELF binaries, especially untrusted samples. The CVE metadata does not identify packaged distributions, downstream products, or a complete affected version range.

Exploitation context

The source bundle does not show KEV listing or any cited active exploitation. A plausible trigger is parsing a malformed ELF file with the vulnerable code path, but the provided sources do not establish real-world exploitation, privilege impact, or reliability.

Researcher notes

The public data is sparse: no CVSS, CWE, CPE, exploit status, or complete version range is provided. Analysis should stay anchored to the CVE description, GitHub issue, and fix commit. Do not assume remote code execution or affected downstream packages without additional vendor evidence.

Mitigation direction

  • Inventory radare/radare2 installations and identify any 2.0.1 deployments.
  • Review radare2 vendor guidance and releases containing the referenced fix commit.
  • Upgrade vulnerable installations to a fixed vendor-supported version where available.
  • Avoid processing untrusted ELF files with vulnerable builds until remediated.
  • Use sandboxing for malware or unknown binary analysis workflows.

Validation and detection

  • Check installed radare/radare2 version on analysis workstations and CI images.
  • Confirm whether local source or package includes commit 0b973e28166636e0ff1fad80baa0385c9c09c53a.
  • Review binary-analysis workflows for untrusted ELF intake.
  • Verify compensating sandbox controls for systems that cannot upgrade immediately.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-16357 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.