Bugzilla – Bug 1214589
VUL-0: CVE-2020-21047: elfutils: denial-of-service inside the libcpu component which is used by libasm
Last modified: 2024-05-28 08:43:18 UTC
CVE-2020-21047 The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks. Upstream fix: https://sourceware.org/git/?p=elfutils.git;a=commitdiff;h=99dc63b10b3878616b85df2dfd2e4e7103e414b8 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-21047 https://www.cve.org/CVERecord?id=CVE-2020-21047 https://sourceware.org/bugzilla/show_bug.cgi?id=25068 https://sourceware.org/git/?p=elfutils.git;a=commitdiff;h=99dc63b10b3878616b85df2dfd2e4e7103e414b8
I'm not the elfutils maintainer. I handed it over to the toolchain team a long time ago. Michael, can you get whatever DB that maintains this info updated with the correct maintainer. Thanks
See https://sourceware.org/git/?p=elfutils.git;a=blob_plain;f=SECURITY;hb=HEAD for the upstream policy regarding fuzzing-based "security vulnerabilities". In particular: Since most elfutils tools are run in short-lived, local, interactive, development context rather than remotely "in production", we generally treat malfunctions as ordinary bugs rather than security vulnerabilities. That applies to this CVE. I suggest to close this as WONTFIX and appropriately mark elfutils generally or this CVE in particular in any customer-facing documentation.
closing