REDHAT-BUG-1677536: Low severity elfutils vulnerability
In elfutils 0.175, a negative-sized memcpy is attempted in elfcvtnote in libelf/notexlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).
Reference: https://sourceware.org/bugzilla/showbug.cgi?id=24084
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1677536?
The severity of REDHAT-BUG-1677536 is classified as medium due to the denial of service caused by a segmentation fault.
How do I fix REDHAT-BUG-1677536?
To fix REDHAT-BUG-1677536, upgrade to the patched version of elfutils that addresses the overflow check issue.
What are the consequences of REDHAT-BUG-1677536?
The consequences of REDHAT-BUG-1677536 include application crashes and service interruptions due to the denial of service vulnerability.
Which versions of elfutils are affected by REDHAT-BUG-1677536?
All versions of elfutils prior to the security patch for REDHAT-BUG-1677536 are affected.
How is REDHAT-BUG-1677536 exploited?
REDHAT-BUG-1677536 can be exploited by providing crafted ELF input which triggers the negative-sized memcpy.