NULL pointer dereference in elfutils - CVE-2024-25260

Vulnerability identifier: #VU105999

CSH Severity: Medium

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-25260

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the handle_verdef() function in readelf.c. A remote attacker can trick the victim into passing a specially crafted file and perform a denial of service (DoS) attack.

elfutils
Ubuntu
Anolis OS
elfutils (Ubuntu package)
elfutils
elfutils-debuginfod
elfutils-debuginfod-client
elfutils-debuginfod-client-devel
elfutils-devel
elfutils-devel-static
elfutils-libelf
elfutils-libelf-devel
elfutils-libelf-devel-static
elfutils-libs
elfutils-default-yama-scope
elfutils-doc

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

elfutils (Ubuntu package) - addressed in versions 0.186-1ubuntu0.1, 0.190-1.1ubuntu0.1, 0.191-2ubuntu0.1
elfutils - update to 0.190-3
elfutils-debuginfod - update to 0.190-3
elfutils-debuginfod-client - update to 0.190-3
elfutils-debuginfod-client-devel - update to 0.190-3
elfutils-devel - update to 0.190-3
elfutils-devel-static - update to 0.190-3
elfutils-libelf - update to 0.190-3
elfutils-libelf-devel - update to 0.190-3
elfutils-libelf-devel-static - update to 0.190-3
elfutils-libs - update to 0.190-3
elfutils-default-yama-scope - update to 0.190-3
elfutils-doc - update to 0.190-3

• https://sourceware.org/bugzilla/show_bug.cgi?id=31058
• https://github.com/schsiung/fuzzer_issues/issues/1

• Multiple vulnerabilities in elfutils
• Ubuntu update for elfutils
• Anolis OS update for elfutils