Denial of Service Vulnerability in GNU elfutils 0.192
Summary
CVE-2025-1377: A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. Affects elfutils versions 0.183-1 – 0.193-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU elfutils is a set of utilities for handling ELF (Executable and Linkable Format) files. It provides tools for manipulating object files, debugging, and profiling. The package is widely used in various Linux distributions, including Debian. The vulnerability in question affects the eu-strip component, specifically the gelf_getsymshndx function, which can lead to a denial of service when exploited.
Vulnerability Detail
A problematic vulnerability has been identified in GNU elfutils version 0.192, specifically in the gelf_getsymshndx function within the strip.c file. This vulnerability allows an attacker to manipulate the function, resulting in a denial of service condition. The attack must be executed locally, and the exploit has been publicly disclosed, making it a significant concern for users of the affected package. The CVSS score for this vulnerability is 3.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit access to the eu-strip utility to trusted users only, thereby reducing the risk of local exploitation. Additionally, monitoring system logs for unusual activity related to elfutils can help identify potential attempts to exploit this vulnerability.
Conclusion
The vulnerability in GNU elfutils 0.192 poses a risk of denial of service, particularly affecting the eu-strip component. Users are encouraged to apply the available patch promptly and consider implementing workarounds to mitigate risks until the patch can be applied. Regular monitoring and using tools like Vulert can help maintain security against such vulnerabilities.
See every vulnerability recorded for elfutils →
FAQ
The vulnerability allows for a denial of service attack through manipulation of the gelf_getsymshndx function in the eu-strip component.
Users of GNU elfutils version 0.192 on Debian systems are affected by this vulnerability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
If you cannot apply the patch right away, consider restricting access to the eu-strip utility and monitoring your system for any suspicious activity.
While the primary risk is denial of service, it is advisable to maintain regular backups to prevent any potential data loss from unforeseen issues.
Related vulnerabilities
Recent vulnerabilities recorded for elfutils.
