CVE-2024-2002: Libdwarf: crashes randomly on fuzzed object
A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.
Other sources
In a multiply-corrupted DWARF object libdwarf may try to dealloc(free) an allocation twice. Results are unpredictable and various. This has been a possibility since we added code to prevent leaks when generating 'unattached' DwarfError records (where there is no DwarfDebug available at the point of error). The problem was introduced in libdwarf-0.1.0 in 2021.
— Red Hat
Libdwarf: crashes randomly on fuzzed object
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libdwarfto a version that resolves this vulnerability.Fixed in 0.9.2 - Upgrade
Upgrade
debian/dwarfutilsto a version that resolves this vulnerability.Fixed in 1:0.11.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2002?
CVE-2024-2002 has a severity rating that can lead to crashes in affected applications due to a double-free vulnerability.
How do I fix CVE-2024-2002?
To fix CVE-2024-2002, you should upgrade libdwarf to version 0.9.3 or later, as it contains the necessary patches.
Which versions are affected by CVE-2024-2002?
CVE-2024-2002 affects libdwarf versions up to and including 0.9.2.
What impact does CVE-2024-2002 have on applications?
CVE-2024-2002 can cause unpredictable behavior and crashes in applications that utilize the affected versions of libdwarf.
Is there a workaround for CVE-2024-2002?
There are no known workarounds for CVE-2024-2002; upgrading to a secure version is the recommended action.