NRDAX-T0005 - Array Deserialization Memcpy Corruption
Fault termination · P2P and gossip · absent invariant · active · first seen 2019-01-01
provenance: Reproduced in NullRabbit's attack-reproduction pipeline
mechanism
CVE-2018-3972 (TALOS-2018-0637): Levin array-of-arrays (0x8D) → epee read_ae POD memcpy → memory corruption
live exposure
No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.
instances (1)
| chain | primitive | fidelity | origin | reproducer (bundle) | source |
|---|---|---|---|---|---|
| monero | monero_levin_array_memcorrupt | lab | reverse-engineered-cve | monero_levin_array_memcorrupt | talosintelligence.com ↗ |
related (Fault termination)
NRDAX-T0001 - Addr Message Counter Overflow Crash active NRDAX-T0013 - Bloom Filter Divide-By-Zero Crash active NRDAX-T0024 - Compact Block FillBlock Duplicate Crash active NRDAX-T0056 - Duplicate Input Validation-Bypass Crash active NRDAX-T0101 - Handshake Crypto Validation Bypass Crash active NRDAX-T0120 - Integer-Overflow Panic Control Message active NRDAX-T0122 - Integer Signedness Index OOB Crash active NRDAX-T0129 - Invalid Curve Point Panic active
cite
https://nrdax.com/techniques/NRDAX-T0005
plain
NRDAX Registry. Technique NRDAX-T0005.
bibtex
@misc{nrdax_NRDAX_T0005,
title = {Array Deserialization Memcpy Corruption (NRDAX-T0005)},
howpublished = {NRDAX Registry},
url = {https://nrdax.com/techniques/NRDAX-T0005},
} json (csl)
{
"id": "nrdax-NRDAX-T0005",
"type": "dataset",
"title": "Array Deserialization Memcpy Corruption (NRDAX-T0005)",
"URL": "https://nrdax.com/techniques/NRDAX-T0005",
"publisher": "NRDAX Registry"
} badge
[](https://nrdax.com/techniques/NRDAX-T0005-array-deserialization-memcpy-corruption)
use from the CLI
Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.
nrdax get NRDAX-T0005nrdax cite NRDAX-T0005 --format bibtex