CVE-2016-9276: High severity red hat libdwarf vulnerability

Q: What must an attacker provide to trigger the denial of service?

The issue is triggered when the dwarfdump utility processes crafted input. Exploitation does not require authentication or user interaction according to the supplied CVSS vector.

Q: Which versions are affected?

Libdwarf versions before 20161124 are affected.

Q: What is the impact of successful exploitation?

A remote attacker can cause a denial of service through an out-of-bounds heap read in dwarf_get_aranges_list.

Q: What remediation is available?

Apply the available upstream patch, or update to a Libdwarf version that is not before 20161124.

Published Nov 14, 2016

Updated

An out of bounds heap read was found in dwarfgetarangeslist in dwarfarrange.c triggered by crafted input to dwarfdump utility.

Upstream patch:

https://sourceforge.net/p/libdwarf/code/ci/583f8834083b5ef834c497f5b47797e16101a9a6/

CVE assignment:

http://seclists.org/oss-sec/2016/q4/403

Other sources

The dwarfgetarangeslist function in dwarfarrange.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read).

— MITRE

Affected Software

1 affected component

Libdwarf Project Libdwarf>=1999-12-14<2016-11-24

Remediation

Event History

Nov 14, 2016

Data Sourced

01:29 PM

DescriptionSeverityAffected Software

Mar 23, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What must an attacker provide to trigger the denial of service?

The issue is triggered when the dwarfdump utility processes crafted input. Exploitation does not require authentication or user interaction according to the supplied CVSS vector.

Which versions are affected?

Libdwarf versions before 20161124 are affected.

What is the impact of successful exploitation?

A remote attacker can cause a denial of service through an out-of-bounds heap read in dwarf_get_aranges_list.

What remediation is available?

Apply the available upstream patch, or update to a Libdwarf version that is not before 20161124.

CVE-2016-9276: High severity red hat libdwarf vulnerability

Other sources

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

What must an attacker provide to trigger the denial of service?

Which versions are affected?

What is the impact of successful exploitation?

What remediation is available?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the denial of service?

Which versions are affected?

What is the impact of successful exploitation?

What remediation is available?