REDHAT-BUG-1625050: Low severity elfutils vulnerability
Elfutils through version 0.173 is vulnerable to a double-free in the libelf/elfend.c:elfend() function due to the decompression of section data multiple times.. An attacker could exploit this to cause a crash or possibly have unspecified other impact via a crafted ELF.
Upstream Bug:
https://sourceware.org/bugzilla/showbug.cgi?id=23528
Upstream Patch:
https://sourceware.org/git/?p=elfutils.git;a=patch;h=56b18521fb8d46d40fc090c0de9d11a08bc982fa
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1625050?
The severity of REDHAT-BUG-1625050 is currently classified as potentially high due to its ability to cause application crashes or other impacts.
How do I fix REDHAT-BUG-1625050?
To fix REDHAT-BUG-1625050, you should upgrade Elfutils to a version later than 0.173 where the vulnerability has been addressed.
What versions are affected by REDHAT-BUG-1625050?
REDHAT-BUG-1625050 affects Elfutils versions up to and including 0.173.
What type of vulnerability is REDHAT-BUG-1625050?
REDHAT-BUG-1625050 is a double-free vulnerability that occurs in the elf_end() function of Elfutils.
What could an attacker achieve by exploiting REDHAT-BUG-1625050?
An attacker exploiting REDHAT-BUG-1625050 could potentially cause a crash of the application or achieve unspecified other impacts.