PT-2018-3618 · Red Hat+5 · Elfutils+6

Wcventure · Published 2018-08-17 · Updated 2023-08-30 · CVE-2018-16062

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions elfutils versions prior to 2018-08-18

Description The issue is related to a buffer over-read in the dwarf getaranges function in dwarf getaranges.c of the Elfutils utility set for processing ELF objects. This can be exploited by a remote attacker to cause a denial of service. The exploitation occurs through a crafted file that triggers a heap-based buffer over-read.

Recommendations For versions prior to 2018-08-18, update to a version released after 2018-08-18 to resolve the issue. As a temporary workaround, consider restricting access to crafted files that could trigger the buffer over-read in the dwarf getaranges function.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2018-2328

BDU:2021-01387

CESA-2019_2197

CVE-2018-16062

DLA-1689-1

DLA-2802-1

MGASA-2019-0222

OPENSUSE-SU-2019:1590-1

OPENSUSE-SU-2019_1590-1

OPENSUSE-SU-2022_2614-1

RHSA-2019:2197

RHSA-2019_2197

SUSE-SU-2019:1486-1

SUSE-SU-2019:1733-1

SUSE-SU-2019_1486-1

SUSE-SU-2022:2614-1

SUSE-SU-2022:2614-2

USN-4012-1

USN-6322-1

Affected Products

Alt Linux

Centos

Linuxmint

Red Hat

Suse

Ubuntu

Elfutils

References · 189

• https://ubuntu.com/security/notices/USN-4012-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01385 · Security Note
• https://osv.dev/vulnerability/USN-6322-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01386 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/Z6QQTO2CLXUBNNOX4DEZ5XXWJYV3SYVN · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01428 · Security Note
• https://osv.dev/vulnerability/DLA-1689-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2197 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01633 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-21047 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18520 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16403 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-2328 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1689-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16402 · Vendor Advisory