A critical vulnerability (CVE-2024-27322) has been discovered in the main implementation of the R programming language, designed for statistical processing, data analysis, and visualization. This vulnerability leads to code execution during the deserialization of unchecked data. The vulnerability can be exploited when processing specially crafted files in RDS (R Data Serialization) and RDX formats used for data exchange between applications. The issue has been resolved in the R 4.4.0 release. Updates for packages in distributions can be tracked on the pages of Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, Arch, and FreeBSD.
The vulnerability is caused by the behavior of the readRDS function, which is used to load files in RDS and RDX formats that allow serialized R objects to be transferred for processing on another system. Serialization allows for capturing states and sharing datasets between programs. The RDS format is used for storing the state of a single object, while the RDX format combined with RDB files allows information about multiple objects to be transmitted. The issue is related to the fact that the RDS format supports the object code PROMSXP, associated with the Promise type, which is used to define expressions called asynchronously when using their associated values.
During deserialization, three components are used to determine a Promise object—its value, expression, and environment. If a precomputed value for the Promise type is not specified, it is computed during deserialization by evaluating the expression using the 'eval' function. Thus, an attacker can achieve arbitrary code execution in R by substituting their own code for the expression related to unresolved values in RDS or RDX files.
Source: opennet.ru
