Upstream information

CVE-2022-4510 at MITRE

Description

A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.
This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.

This issue affects binwalk from 2.1.2b through 2.3.3 included.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

CVSS v3 Scores
CVSS detail CNA (research@onekey.com) National Vulnerability Database
Base Score 7.8 7.8
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local Local
Attack Complexity Low Low
Privileges Required None None
User Interaction Required Required
Scope Unchanged Unchanged
Confidentiality Impact High High
Integrity Impact High High
Availability Impact High High
CVSSv3 Version 3.1 3.1
SUSE Bugzilla entry: 1207744 [IN_PROGRESS]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • binwalk >= 2.3.3-2.1
 Patchnames:
openSUSE-Tumbleweed-2024-12649

SUSE Timeline for this CVE

CVE page created: Fri Jan 27 01:03:45 2023
CVE page last modified: Mon Oct 6 19:35:42 2025