CVE-2018-18520: Buffer Overflow
A flaw was found in elfutils through v0.174. An Invalid Memory Address Dereference exists in the function elfend in libelf. Although eu-size is intended to support ar files inside ar files, handlear in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.
References: https://sourceware.org/bugzilla/showbug.cgi?id=23787 https://sourceware.org/ml/elfutils-devel/2018-q4/msg00057.html
Upstream Patch: https://sourceware.org/git/?p=elfutils.git;a=commit;h=22d2d082d57a7470fadc0eae67179553f4919209
Other sources
An Invalid Memory Address Dereference exists in the function elfend in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handlear in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-18520?
CVE-2018-18520 is classified as a medium severity vulnerability due to its potential impact on system stability.
How do I fix CVE-2018-18520?
To fix CVE-2018-18520, upgrade the elfutils package to version 0.183-1, 0.188-2.1, or 0.192-4 or later.
What type of vulnerability is CVE-2018-18520?
CVE-2018-18520 is an Invalid Memory Address Dereference vulnerability affecting the elf_end function in libelf.
Which systems are affected by CVE-2018-18520?
CVE-2018-18520 affects various versions of the elfutils package on Debian, Ubuntu, and OpenSUSE.
What are the potential consequences of CVE-2018-18520?
Exploiting CVE-2018-18520 may lead to application crashes or unexpected behavior due to memory manipulation.