{"id":115448,"date":"2024-04-30T13:53:09","date_gmt":"2024-04-30T11:53:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-realizaczii-yazyka-r-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-fajlov-rds-i-rdx"},"modified":"2024-04-30T13:53:09","modified_gmt":"2024-04-30T11:53:09","slug":"uyazvimost-v-realizaczii-yazyka-r-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-fajlov-rds-i-rdx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-realizaczii-yazyka-r-pozvolyayushhaya-vypolnit-kod-pri-obrabotke-fajlov-rds-i-rdx","title":{"rendered":"A vulnerability in the implementation of the R language allows code execution when processing rds and rdx files.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A critical vulnerability (CVE-2024-27322) has been discovered in the main implementation of the R programming language, designed for statistical processing, data analysis, and visualization. This vulnerability leads to code execution during the deserialization of unchecked data. The vulnerability can be exploited when processing specially crafted files in RDS (R Data Serialization) and RDX formats used for data exchange between applications. The issue has been resolved in the R 4.4.0 release. Updates for packages in distributions can be tracked on the pages of Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, and FreeBSD. <\/p>\n
The vulnerability is caused by the behavior of the readRDS function, which is used to load files in RDS and RDX formats that allow serialized R objects to be transferred for processing on another system. Serialization allows for capturing states and sharing datasets between programs. The RDS format is used for storing the state of a single object, while the RDX format combined with RDB files allows information about multiple objects to be transmitted. The issue is related to the fact that the RDS format supports the object code PROMSXP, associated with the Promise type, which is used to define expressions called asynchronously when using their associated values. <\/p>\n
During deserialization, three components are used to determine a Promise object \u2014 the Promise value, the expression, and the environment. If a pre-computed value for the Promise type is not specified, it is computed during deserialization by executing the expression using the \"eval\" function. Thus, an attacker can achieve the execution of arbitrary code in R by substituting it for the expression associated with uncomputed values in RDS or RDX files. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"