PT-2024-29909 · Homebrew · Homebrew

Published 2024-07-31 · Updated 2024-08-12 · CVE-2024-42381

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R

Name of the Vulnerable Software and Affected Versions Homebrew versions prior to 4.2.20

Description The issue allows attackers to achieve code execution via an ELF file with a custom .interp section. This occurs during an un-sandboxed binary relocation phase, before a user would expect execution of downloaded package content.

Recommendations For versions prior to 4.2.20, upgrade to version 4.2.20 or later to mitigate the risk of exploitation. As a temporary workaround, consider avoiding the use of os/linux/elf.rb in Homebrew brew until a patch is applied. Restrict access to untrusted ELF files to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-830

Related Identifiers

CVE-2024-42381

Affected Products

Homebrew

References · 12

• https://osv.dev/vulnerability/CVE-2024-42381 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42381 · Security Note
• https://github.com/Homebrew/brew/commit/916b37388d3851a8a93a8e9b4adc38873680ead7 · Note
• https://github.com/Homebrew/brew/pull/17136 · Note
• https://github.com/Homebrew/brew/tree/237d1e783f7ee261beaba7d3f6bde22da7148b0a · Note
• https://github.com/Homebrew/brew/releases/tag/4.2.20 · Note
• https://github.com/trailofbits/publications/blob/master/reviews/2023-08-28-homebrew-securityreview.pdf · Note
• https://twitter.com/oktsec/status/1822954743007748316 · Twitter Post
• https://t.me/cvenotify/88004 · Telegram Post
• https://brew.sh/2024/07/30/homebrew-security-audit · Note
• https://t.me/cvedetector/2114 · Telegram Post
• https://blog.trailofbits.com/2024/07/30/our-audit-of-homebrew · Note