Heap-based Buffer Over-read in libdw in elfutils
Summary
CVE-2019-7149: A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. Affects elfutils across 2 version ranges.
< 0.176-r0
< 4ea9a2db164caadf836a65d5cdffb09a2d5a37ce
Fixed in 0.176-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Elfutils is a collection of libraries and utilities for handling ELF (Executable and Linkable Format) files. It provides various functions for reading and manipulating ELF files. The vulnerability affects the libdw library in elfutils, specifically the function read_srclines in dwarf_getsrclines.c. This library is commonly used for debugging and analyzing ELF files. The vulnerability allows an attacker to cause segmentation faults, leading to denial-of-service.
Vulnerability Detail
The vulnerability, identified as CVE-2019-7149, is a heap-based buffer over-read. It occurs when the read_srclines function in libdw attempts to read beyond the bounds of a buffer. An attacker can exploit this by providing a crafted input, which triggers a segmentation fault and results in a denial-of-service condition. The vulnerability has a CVSS v3 score of 6.5, indicating a medium severity level.
How To Fix
Minimum fixed version
0.176-r0
This is the first release that contains the fix.
sudo apk add --upgrade elfutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The heap-based buffer over-read vulnerability in libdw in elfutils can be exploited to cause denial-of-service. It is recommended to update the affected package to version 0.176-r0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for elfutils →
FAQ
The vulnerability can be exploited to cause segmentation faults, leading to denial-of-service. However, it does not allow for remote code execution or privilege escalation.
The vulnerability affects elfutils versions 0.175 and earlier.
There is no known exploit available for this vulnerability at the moment.
Updating to the fixed version of elfutils is the recommended mitigation for this vulnerability.
There is no evidence of active exploitation of this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for elfutils.
