Segmentation Fault Vulnerability in elfutils Package: CVE-2019-7664
Summary
ALPINE-CVE-2019-7664: In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Affects elfutils versions < 0.176-r0. Fixed in 0.176-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The elfutils package is a collection of utilities for handling ELF (Executable and Linkable Format) files, commonly used in Unix-like operating systems. It provides tools for inspecting and manipulating ELF binaries, which are essential for debugging and profiling applications. The package is widely utilized in various software development environments, making its security critical. The vulnerability in question arises from an incorrect overflow check in the elf_cvt_note function, leading to potential crashes.
Vulnerability Detail
In elfutils version 0.175, a negative-sized memcpy is attempted in the elf_cvt_note function due to an incorrect overflow check. This vulnerability allows crafted ELF input to cause a segmentation fault, resulting in a denial of service (program crash). The issue can be exploited by attackers to disrupt services that rely on the elfutils package, potentially affecting system stability and availability.
How To Fix
Minimum fixed version
0.176-r0
This is the first release that contains the fix.
sudo apk add --upgrade elfutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted ELF files until the package is updated. Implement input validation to ensure that only safe and verified ELF files are handled by the application.
Conclusion
The CVE-2019-7664 vulnerability in the elfutils package poses a risk of denial of service due to a segmentation fault caused by an incorrect overflow check. It is crucial to update the package to version 0.176-r0 or later to mitigate this risk. Users should also consider using Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for elfutils →
FAQ
CVE-2019-7664 is a vulnerability in the elfutils package that can lead to a segmentation fault and denial of service due to an incorrect overflow check.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score of CVE-2019-7664 is 5.5, indicating a moderate severity level.
The vulnerability can lead to application crashes, causing denial of service and potentially affecting system stability.
Yes, a patch is available in version 0.176-r0 of the elfutils package. Updating to this version will resolve the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for elfutils.
