Low: elfutils

Issue Overview:

An out-of-bounds read was discovered in elfutils in the way it reads DWARF address ranges information. Function dwarf_getaranges() in dwarf_getaranges.c does not properly check whether it reads beyond the limits of the ELF section. An attacker could use this flaw to cause a denial of service via a crafted file.(CVE-2018-16062)

libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.(CVE-2018-16402)

libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.(CVE-2018-16403)

An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.(CVE-2018-18310)

An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.(CVE-2018-18520)

Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.(CVE-2018-18521)

A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.(CVE-2019-7149)

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.(CVE-2019-7150)

In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).(CVE-2019-7664)

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.(CVE-2019-7665)

Affected Packages:

elfutils

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update elfutils to update your system.

New Packages:

aarch64:  
    elfutils-0.176-2.amzn2.aarch64  
    elfutils-libs-0.176-2.amzn2.aarch64  
    elfutils-devel-0.176-2.amzn2.aarch64  
    elfutils-devel-static-0.176-2.amzn2.aarch64  
    elfutils-libelf-0.176-2.amzn2.aarch64  
    elfutils-libelf-devel-0.176-2.amzn2.aarch64  
    elfutils-libelf-devel-static-0.176-2.amzn2.aarch64  
    elfutils-debuginfo-0.176-2.amzn2.aarch64  
  
i686:  
    elfutils-0.176-2.amzn2.i686  
    elfutils-libs-0.176-2.amzn2.i686  
    elfutils-devel-0.176-2.amzn2.i686  
    elfutils-devel-static-0.176-2.amzn2.i686  
    elfutils-libelf-0.176-2.amzn2.i686  
    elfutils-libelf-devel-0.176-2.amzn2.i686  
    elfutils-libelf-devel-static-0.176-2.amzn2.i686  
    elfutils-debuginfo-0.176-2.amzn2.i686  
  
noarch:  
    elfutils-default-yama-scope-0.176-2.amzn2.noarch  
  
src:  
    elfutils-0.176-2.amzn2.src  
  
x86_64:  
    elfutils-0.176-2.amzn2.x86_64  
    elfutils-libs-0.176-2.amzn2.x86_64  
    elfutils-devel-0.176-2.amzn2.x86_64  
    elfutils-devel-static-0.176-2.amzn2.x86_64  
    elfutils-libelf-0.176-2.amzn2.x86_64  
    elfutils-libelf-devel-0.176-2.amzn2.x86_64  
    elfutils-libelf-devel-static-0.176-2.amzn2.x86_64  
    elfutils-debuginfo-0.176-2.amzn2.x86_64  

Additional References

Red Hat: CVE-2018-16062, CVE-2018-16402, CVE-2018-16403, CVE-2018-18310, CVE-2018-18520, CVE-2018-18521, CVE-2019-7149, CVE-2019-7150, CVE-2019-7664, CVE-2019-7665

Mitre: CVE-2018-16062, CVE-2018-16402, CVE-2018-16403, CVE-2018-18310, CVE-2018-18520, CVE-2018-18521, CVE-2019-7149, CVE-2019-7150, CVE-2019-7664, CVE-2019-7665