NULL pointer dereference in elfutils - CVE-2025-1371

Vulnerability identifier: #VU106002

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-1371

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the handle_dynamic_symtab() function in readelf.c. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

elfutils
Ubuntu
openEuler
elfutils (Ubuntu package)
elfutils-default-yama-scope
elfutils-libs
elfutils-libelf-devel
elfutils-libelf
elfutils-help
elfutils-extra
elfutils-devel
elfutils-debugsource
elfutils-debuginfod-client-devel
elfutils-debuginfod-client
elfutils-debuginfod
elfutils-debuginfo
elfutils

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

elfutils (Ubuntu package) - addressed in versions 0.186-1ubuntu0.1, 0.190-1.1ubuntu0.1, 0.191-2ubuntu0.1
elfutils-default-yama-scope - update to 0.190-8
elfutils-libs - update to 0.190-8
elfutils-libelf-devel - update to 0.190-8
elfutils-libelf - update to 0.190-8
elfutils-help - update to 0.190-8
elfutils-extra - update to 0.190-8
elfutils-devel - update to 0.190-8
elfutils-debugsource - update to 0.190-8
elfutils-debuginfod-client-devel - update to 0.190-8
elfutils-debuginfod-client - update to 0.190-8
elfutils-debuginfod - update to 0.190-8
elfutils-debuginfo - update to 0.190-8
elfutils - update to 0.190-8

• https://sourceware.org/bugzilla/attachment.cgi?id=15926
• https://sourceware.org/bugzilla/show_bug.cgi?id=32655
• https://vuldb.com/?ctiid.295978
• https://vuldb.com/?id.295978
• https://vuldb.com/?submit.496484

• Multiple vulnerabilities in elfutils
• Ubuntu update for elfutils
• openEuler 24.03 LTS update for elfutils
• openEuler 24.03 LTS SP1 update for elfutils