RHEL 7 : libdwarf (Unpatched Vulnerability)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory libdwarf. The text
# itself is copyright (C) Red Hat, Inc.
##

include('compat.inc');

if (description)
{
  script_id(196160);
  script_version("1.0");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/11");

  script_cve_id(
    "CVE-2016-2091",
    "CVE-2016-5027",
    "CVE-2016-5028",
    "CVE-2016-5029",
    "CVE-2016-5030",
    "CVE-2016-5031",
    "CVE-2016-5032",
    "CVE-2016-5033",
    "CVE-2016-5034",
    "CVE-2016-5035",
    "CVE-2016-5036",
    "CVE-2016-5037",
    "CVE-2016-5038",
    "CVE-2016-5039",
    "CVE-2016-5040",
    "CVE-2016-5041",
    "CVE-2016-5042",
    "CVE-2016-5043",
    "CVE-2016-5044",
    "CVE-2016-7410",
    "CVE-2016-7510",
    "CVE-2016-7511",
    "CVE-2016-8679",
    "CVE-2016-8680",
    "CVE-2016-8681",
    "CVE-2016-9276",
    "CVE-2016-9480",
    "CVE-2016-9558",
    "CVE-2017-9052",
    "CVE-2017-9053",
    "CVE-2017-9054",
    "CVE-2017-9055",
    "CVE-2017-9998",
    "CVE-2019-14249",
    "CVE-2020-27545",
    "CVE-2020-28163",
    "CVE-2024-2002",
    "CVE-2024-31745"
  );

  script_name(english:"RHEL 7 : libdwarf (Unpatched Vulnerability)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat 7 host is affected by multiple vulnerabilities that will not be patched.");
  script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple
vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libdwarf: heap-based buffer over-read in dwarf_formsdata() (CVE-2017-9055)

  - The dwarf_read_cie_fde_prefix function in dwarf_frame2.c in libdwarf 20151114 allows attackers to cause a
    denial of service (out-of-bounds read) via a crafted ELF object file. (CVE-2016-2091)

  - dwarf_form.c in libdwarf 20160115 allows remote attackers to cause a denial of service (crash) via a
    crafted elf file. (CVE-2016-5027)

  - The print_frame_inst_bytes function in libdwarf before 20160923 allows remote attackers to cause a denial
    of service (NULL pointer dereference) via an object file with empty bss-like sections. (CVE-2016-5028)

  - The create_fullest_file_path function in libdwarf before 20160923 allows remote attackers to cause a
    denial of service (NULL pointer dereference) via a crafted dwarf file. (CVE-2016-5029)

  - The _dwarf_calculate_info_section_end_ptr function in libdwarf before 20160923 allows remote attackers to
    cause a denial of service (NULL pointer dereference) via a crafted file. (CVE-2016-5030)

  - The print_frame_inst_bytes function in libdwarf before 20160923 allows remote attackers to cause a denial
    of service (out-of-bounds read) via a crafted file. (CVE-2016-5031)

  - The dwarf_get_xu_hash_entry function in libdwarf before 20160923 allows remote attackers to cause a denial
    of service (crash) via a crafted file. (CVE-2016-5032)

  - The print_exprloc_content function in libdwarf before 20160923 allows remote attackers to cause a denial
    of service (out-of-bounds read) via a crafted file. (CVE-2016-5033)

  - dwarf_elf_access.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-
    of-bounds write) via a crafted file, related to relocation records. (CVE-2016-5034)

  - The _dwarf_read_line_table_header function in dwarf_line_table_reader.c in libdwarf before 20160923 allows
    remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. (CVE-2016-5035)

  - The dump_block function in print_sections.c in libdwarf before 20160923 allows remote attackers to cause a
    denial of service (out-of-bounds read) via crafted frame data. (CVE-2016-5036)

  - The _dwarf_load_section function in libdwarf before 20160923 allows remote attackers to cause a denial of
    service (NULL pointer dereference) via a crafted file. (CVE-2016-5037)

  - The dwarf_get_macro_startend_file function in dwarf_macro5.c in libdwarf before 20160923 allows remote
    attackers to cause a denial of service (out-of-bounds read) via a crafted string offset for .debug_str.
    (CVE-2016-5038)

  - The get_attr_value function in libdwarf before 20160923 allows remote attackers to cause a denial of
    service (out-of-bounds read) via a crafted object with all-bits on. (CVE-2016-5039)

  - libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read and
    crash) via a large length value in a compilation unit header. (CVE-2016-5040)

  - dwarf_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL
    pointer dereference) via a debugging information entry using DWARF5 and without a DW_AT_name.
    (CVE-2016-5041)

  - The dwarf_get_aranges_list function in libdwarf before 20160923 allows remote attackers to cause a denial
    of service (infinite loop and crash) via a crafted DWARF section. (CVE-2016-5042)

  - The dwarf_dealloc function in libdwarf before 20160923 allows remote attackers to cause a denial of
    service (out-of-bounds read and crash) via a crafted DWARF section. (CVE-2016-5043)

  - The WRITE_UNALIGNED function in dwarf_elf_access.c in libdwarf before 20160923 allows remote attackers to
    cause a denial of service (out-of-bounds write and crash) via a crafted DWARF section. (CVE-2016-5044)

  - The _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to cause a
    denial of service (buffer over-read) via a crafted file. (CVE-2016-7410)

  - The read_line_table_program function in dwarf_line_table_reader_common.c in libdwarf before 20160923
    allows remote attackers to cause a denial of service (out-of-bounds read) via crafted input.
    (CVE-2016-7510)

  - Integer overflow in the dwarf_die_deliv.c in libdwarf 20160613 allows remote attackers to cause a denial
    of service (crash) via a crafted file. (CVE-2016-7511)

  - The _dwarf_get_size_of_val function in libdwarf/dwarf_util.c in Libdwarf before 20161124 allows remote
    attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted
    file. (CVE-2016-8679)

  - The _dwarf_get_abbrev_for_code function in dwarf_util.c in libdwarf 20161001 and earlier allows remote
    attackers to cause a denial of service (out-of-bounds read) by calling the dwarfdump command on a crafted
    file. (CVE-2016-8680, CVE-2016-8681)

  - The dwarf_get_aranges_list function in dwarf_arrange.c in Libdwarf before 20161124 allows remote attackers
    to cause a denial of service (out-of-bounds read). (CVE-2016-9276)

  - libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial
    of service by using the malformed dwarf file approach, related to a Heap Buffer Over-read issue
    affecting the dwarf_util.c component, aka DW201611-006. (CVE-2016-9480)

  - (1) libdwarf/dwarf_leb.c and (2) dwarfdump/print_frames.c in libdwarf before 20161124 allow remote
    attackers to have unspecified impact via a crafted bit pattern in a signed leb number, aka a negation
    overflow. (CVE-2016-9558)

  - An issue, also known as DW201703-006, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read
    in dwarf_formsdata() is due to a failure to check a pointer for being in bounds (in a few places in this
    function) and a failure in a check in dwarf_attr_list(). (CVE-2017-9052)

  - An issue, also known as DW201703-005, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read
    in _dwarf_read_loc_expr_op() is due to a failure to check a pointer for being in bounds (in a few places
    in this function). (CVE-2017-9053)

  - An issue, also known as DW201703-002, was discovered in libdwarf 2017-03-21. In
    _dwarf_decode_s_leb128_chk() a byte pointer was dereferenced just before it was checked for being in
    bounds, leading to a heap-based buffer over-read. (CVE-2017-9054)

  - The _dwarf_decode_s_leb128_chk function in dwarf_leb.c in libdwarf through 2017-06-28 allows remote
    attackers to cause a denial of service (Segmentation fault) via a crafted file. (CVE-2017-9998)

  - dwarf_elf_load_headers.c in libdwarf before 2019-07-05 allows attackers to cause a denial of service
    (division by zero) via an ELF file with a zero-size section group (SHT_GROUP), as demonstrated by
    dwarfdump. (CVE-2019-14249)

  - libdwarf before 20201017 has a one-byte out-of-bounds read because of an invalid pointer dereference via
    an invalid line table in a crafted object. (CVE-2020-27545)

  - libdwarf before 20201201 allows a dwarf_print_lines.c NULL pointer dereference and application crash via a
    DWARF5 line-table header that has an invalid FORM for a pathname. (CVE-2020-28163)

  - A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try
    to dealloc(free) an allocation twice, potentially causing unpredictable and various results.
    (CVE-2024-2002)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-2002. Reason: This candidate is a
    duplicate of CVE-2024-2002. Notes: All CVE users should reference CVE-2024-2002 instead of this candidate.
    (CVE-2024-31745)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package
is installed.");
  script_set_attribute(attribute:"solution", value:
"The vendor has acknowledged the vulnerabilities but no solution has been provided. Refer to the vendor for remediation
guidance.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-9055");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libdwarf");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm.inc');
include('rhel.inc');

if (!get_kb_item("global_settings/vendor_unpatched"))
exit(0, "Unpatched Vulnerabilities Detection not active.");

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '7')) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);

var constraints = [
  {
    'pkgs': [
      {'reference':'libdwarf', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'libdwarf'}
    ]
  }
];


var flag = 0;
foreach var constraint_array ( constraints ) {
  var repo_relative_urls = NULL;
  var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);
  foreach var pkg ( constraint_array['pkgs'] ) {
    var unpatched_pkg = NULL;
    var _release = NULL;
    var sp = NULL;
    var el_string = NULL;
    var rpm_spec_vers_cmp = NULL;
    var exists_check = NULL;
    var cves = NULL;
    if (!empty_or_null(pkg['unpatched_pkg'])) unpatched_pkg = pkg['unpatched_pkg'];
    if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (unpatched_pkg &&
        _release &&
        (!exists_check || rpm_exists(release:_release, rpm:exists_check)) &&
        unpatched_package_exists(release:_release, package:unpatched_pkg, cves: cves)) flag++;
  }
}

if (flag)
{
  var extra = NULL;
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : unpatched_packages_report()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libdwarf');
}