PT-2019-1675 · Red Hat+5 · Elfutils+6

Mark Wielaard

·

Published

2019-01-18

·

Updated

2023-08-30

·

CVE-2019-7149

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions elfutils version 0.175
Description A heap-based buffer over-read was discovered in the read srclines function in dwarf getsrclines.c in libdw in elfutils. This issue can be exploited by a crafted input, causing segmentation faults and leading to a denial-of-service (DoS). The vulnerability can be triggered by a specially prepared ELF file.
Recommendations For elfutils version 0.175, consider applying a patch to fix the read srclines function in dwarf getsrclines.c to prevent the buffer over-read. As a temporary workaround, restrict the use of the eu-nm tool with untrusted ELF files until a patch is available.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-1249
BDU:2019-01237
CESA-2019_2197
CESA-2019_3575
CVE-2019-7149
DLA-1689-1
MGASA-2019-0222
OPENSUSE-SU-2022_2614-1
RHSA-2019:2197
RHSA-2019:3575
RHSA-2019_2197
RHSA-2019_3575
SUSE-SU-2022:2614-1
SUSE-SU-2022:2614-2
USN-4012-1
USN-6322-1

Affected Products

Alt Linux
Centos
Linuxmint
Red Hat
Suse
Ubuntu
Elfutils