PT-2019-1674 · Red Hat+2 · Elfutils+2
Mark Wielaard
·
Published
2018-11-16
·
Updated
2022-08-01
·
CVE-2019-7148
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
elfutils versions 0.174
Description
The issue is related to the function
read long names() in the elfutils utility for modifying and analyzing ELF binary files. It involves excessive memory allocation, which can be exploited by remote attackers to cause a denial-of-service via crafted ELF input, leading to an out-of-memory exception.Recommendations
For elfutils version 0.174, consider setting ASAN OPTIONS=allocator may return null=1 to mitigate the risk of out-of-memory exceptions, as the maintainers suggest this may prevent the issue from occurring.
Exploit
Fix
DoS
Buffer Overflow
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Suse
Elfutils