Lucene search

RedhatVULNRICHMENT:CVE-2024-2002

HistoryMar 18, 2024 - 12:26 p.m.

CVE-2024-2002 Libdwarf: crashes randomly on fuzzed object

2024-03-1812:26:31

CWE-415

redhat

github.com

libdwarf

double-free vulnerability

fuzzed object

unpredictable results

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.1

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.

References

access.redhat.com/security/cve/CVE-2024-2002

bugzilla.redhat.com/show_bug.cgi?id=2267700

github.com/davea42/libdwarf-code/blob/main/bugxml/data.txt

lists.fedoraproject.org/archives/list/[email protected]/message/ZGPVLSPIXR32J6FOAFTTIMYTUUXJICGW/

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.1

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2024-2002