Segmentation Fault Vulnerability in elfutils Package - CVE-2019-7150
Summary
ALPINE-CVE-2019-7150: An issue was discovered in elfutils 0.175. Affects elfutils versions < 0.176-r0. Fixed in 0.176-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The elfutils package is a set of utilities for handling ELF (Executable and Linkable Format) files, commonly used in Unix-like operating systems. It provides tools for examining and manipulating ELF files, which are essential for program execution and debugging. The package is widely utilized in various applications, making it critical for system stability and performance. However, a vulnerability has been identified that could lead to a denial-of-service condition due to improper handling of core files.
Vulnerability Detail
An issue was discovered in elfutils version 0.175, where a segmentation fault can occur in the function elf64_xlatetom within the libelf/elf32_xlatetom.c file. This vulnerability arises because the dwfl_segment_report_module function does not adequately check whether the dynamic data read from a core file is truncated. A crafted input can exploit this flaw, resulting in a program crash and leading to a denial-of-service scenario. The CVSS score for this vulnerability is 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.176-r0
This is the first release that contains the fix.
sudo apk add --upgrade elfutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the elfutils tools that interact with core files until the package is updated. This may help mitigate the risk of encountering the segmentation fault.
Conclusion
The elfutils package has a significant vulnerability (CVE-2019-7150) that can lead to a segmentation fault and denial-of-service. It is crucial to update to the patched version (0.176-r0) to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for elfutils →
FAQ
CVE-2019-7150 is a vulnerability in the elfutils package that can cause a segmentation fault, leading to a denial-of-service condition.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The primary impact of this vulnerability is a denial-of-service condition, which can cause applications using elfutils to crash unexpectedly.
Yes, a patched version of the elfutils package (0.176-r0) is available. Updating to this version will resolve the vulnerability.
If an immediate update is not possible, refrain from using elfutils tools that interact with core files to minimize the risk of encountering the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for elfutils.
