Excessive Memory Allocation in libelf in elfutils
Summary
CVE-2019-7148: An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Affects elfutils across 2 version ranges.
< 0.176-r0
< 52b6b2f1f49e7385527e9f311f248092be0c0b61
Fixed in 0.176-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
elfutils is a package that provides a collection of utilities for handling ELF (Executable and Linkable Format) files. It includes tools for reading, writing, and manipulating ELF files. The package is widely used in various Linux distributions. However, a vulnerability has been discovered in the libelf component of elfutils.
Vulnerability Detail
The vulnerability, identified as CVE-2019-7148, involves an attempted excessive memory allocation in the function read_long_names in elf_begin.c. This vulnerability exists in elfutils version 0.174. An attacker can exploit this vulnerability by providing crafted ELF input, leading to an out-of-memory exception. The maintainers of elfutils believe that this is not a real issue, but rather a warning caused by ASAN (AddressSanitizer) due to the large allocation. By setting ASAN_OPTIONS=allocator_may_return_null=1 and running the reproducer, no adverse effects are observed.
How To Fix
Minimum fixed version
0.176-r0
This is the first release that contains the fix.
sudo apk add --upgrade elfutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The excessive memory allocation vulnerability in libelf in elfutils can lead to a denial-of-service condition. It is recommended to update to version 0.176-r0 or later to mitigate this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for elfutils →
FAQ
elfutils is a package that provides utilities for handling ELF files in Linux distributions.
The vulnerability can be exploited to cause a denial-of-service by consuming excessive memory.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability.
No specific workarounds have been provided for this vulnerability.
The CVSS score of this vulnerability is 6.5.
Related vulnerabilities
Recent vulnerabilities recorded for elfutils.
