CVE-2019-7148: Medium severity centos elfutils vulnerability
An attempted excessive memory allocation was discovered in the function readlongnames in elfbegin.c in libelf in elfutils 0.174. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted elf input, which leads to an out-of-memory exception. NOTE: The maintainers believe this is not a real issue, but instead a "warning caused by ASAN because the allocation is big. By setting ASANOPTIONS=allocatormayreturnnull=1 and running the reproducer, nothing happens."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7148?
CVE-2019-7148 is classified as a denial-of-service vulnerability.
How do I fix CVE-2019-7148?
To mitigate CVE-2019-7148, upgrade to a version of elfutils later than 0.174 that addresses this memory allocation issue.
Who is affected by CVE-2019-7148?
CVE-2019-7148 affects users and systems utilizing elfutils version 0.174.
What type of attack does CVE-2019-7148 enable?
CVE-2019-7148 can be exploited by remote attackers to trigger a denial-of-service via specially crafted ELF input.
What is the impact of CVE-2019-7148?
The impact of CVE-2019-7148 is an out-of-memory exception that can lead to service disruption.