Buffer Over-read Vulnerability in elfutils
Summary
CVE-2019-7146: In elfutils 0.175, there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl. Affects elfutils across 2 version ranges.
< 0.176-r0
< 4ea9a2db164caadf836a65d5cdffb09a2d5a37ce
Fixed in 0.176-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
elfutils is a package that provides utilities for handling ELF (Executable and Linkable Format) files. It is commonly used in Linux systems for debugging and analyzing executables. The package includes various tools such as eu-readelf, eu-objdump, and eu-nm. These tools allow users to extract information from ELF files, such as symbols, sections, and program headers. However, a buffer over-read vulnerability has been discovered in elfutils version 0.175.
Vulnerability Detail
The vulnerability, identified as CVE-2019-7146, exists in the ebl_object_note function in the eblobjnote.c file of libebl. It can be exploited by remote attackers through a crafted ELF file. By leveraging this vulnerability, an attacker can cause a denial-of-service (DoS) condition. The specific impact and potential consequences of the DoS attack may vary depending on the context in which the vulnerable package is used. The vulnerability has a CVSS v3 score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.176-r0
This is the first release that contains the fix.
sudo apk add --upgrade elfutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No known workarounds are available for this vulnerability.
Conclusion
In conclusion, the buffer over-read vulnerability in elfutils version 0.175 can be exploited by remote attackers to cause a denial-of-service condition. To mitigate this vulnerability, it is recommended to update the elfutils package to version 0.176-r0 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for elfutils →
FAQ
elfutils is a package that provides utilities for handling ELF files in Linux systems. It includes tools for extracting information from ELF files, such as symbols and sections.
The vulnerability allows remote attackers to cause a denial-of-service (DoS) condition by exploiting a buffer over-read issue in the ebl_object_note function of libebl.
To fix this vulnerability, update the elfutils package to version 0.176-r0 or later.
No known workarounds are available for this vulnerability.
The CVSS v3 score of this vulnerability is 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for elfutils.
