Executive brief
CodeChecker, a tool used for static and dynamic software analysis, contains a flaw in its logging component. An attacker could provide specially crafted input to the 'log' command to cause a system crash or potentially execute unauthorized code. This could allow a local user to disrupt operations or gain unauthorized access to the system where the tool is running.
Technical details
A stack-based buffer overflow exists in the internal 'ldlogger' library of CodeChecker due to the unsafe use of the 'strcpy()' function. The vulnerability occurs when the 'CodeChecker log' command processes command-line arguments, as the destination buffer is fixed at 4096 bytes without length validation. A local attacker can exploit this by providing a crafted, overly long path or argument to the '-b' flag, potentially leading to arbitrary code execution or a denial-of-service condition. The issue is addressed in version 6.26.2.
Affected products
- Ericsson CodeChecker <= 6.26.1
Timeline
- 2025-09-22: disclosed
- 2025-09-22: advisory
- 2025-09-22: patched: Fixed in version 6.26.2
References
- https://api.github.com/users/barnabasdomozi
- https://github.com/barnabasdomozi
- https://api.github.com/users/barnabasdomozi/gists%7B/gist_id%7D
- https://api.github.com/users/barnabasdomozi/repos
- https://avatars.githubusercontent.com/u/142594183?v=4
- https://api.github.com/users/barnabasdomozi/events%7B/privacy%7D