CVE-2022-4510

Advisory

Affected versions of binwalk from 2.1.2b through 2.3.3 included are vulnerable to path traversal and remote code execution. By crafting a malicious PFS filesystem file, an attacker can trigger the PFS extractor when binwalk is run in extraction mode (-e), causing files to be extracted to arbitrary locations. The vulnerability is associated with src/binwalk/plugins/unpfs.py.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-3cm8-v4mc-gppg
• https://nvd.nist.gov/vuln/detail/CVE-2022-4510
• https://github.com/ReFirmLabs/binwalk/pull/617
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4510