CVE-2015-8538: Input Validation

Q: Who is exposed to this denial-of-service issue?

Systems that use dwarfdump with the affected libdwarf code are exposed when they process attacker-supplied ELF files. The impact described is a SIGSEGV crash, resulting in denial of service.

Q: What must an attacker do to trigger the crash?

An attacker needs to cause a crafted ELF file to be passed to dwarfdump. The CVSS vector indicates network attack access is possible, no privileges are required, and user interaction is required.

Published Dec 14, 2015

Updated

dwarfleb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).

Other sources

It was found that if an ELF file is passed to dwarfdump, SIGSEGV will occur in libdwarf/dwarfleb.c.

Product bug (includes reproducer):

https://bugzilla.redhat.com/showbug.cgi?id=1289385

CVE assignment:

http://seclists.org/oss-sec/2015/q4/464

— Red Hat

Affected Software

1 affected component

Libdwarf Project Libdwarf>=1999-12-14<=2015-11-14

Event History

Dec 14, 2015

Data Sourced

02:21 PM

DescriptionSeverityAffected Software

Jun 7, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Systems that use dwarfdump with the affected libdwarf code are exposed when they process attacker-supplied ELF files. The impact described is a SIGSEGV crash, resulting in denial of service.

What must an attacker do to trigger the crash?

An attacker needs to cause a crafted ELF file to be passed to dwarfdump. The CVSS vector indicates network attack access is possible, no privileges are required, and user interaction is required.

CVE-2015-8538: Input Validation

Other sources

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What must an attacker do to trigger the crash?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What must an attacker do to trigger the crash?