Bug 2265194 (CVE-2024-25260)
| Summary: | CVE-2024-25260 elfutils: global-buffer-overflow exists in the function ebl_machine_flag_name in eblmachineflagname.c | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Patrick Del Bello <pdelbell> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | amerey, fweimer, jakub, mcermak, michal.skrivanek, mjw, mperina, ohudlick, sipoyare |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | elfutils 0.190 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A NULL pointer dereference vulnerability in the elfutils library has been discovered. This vulnerability occurs within the handle_verdef() function in the readelf.c source file. A NULL pointer dereference typically happens when a program attempts to access memory using a pointer that is not pointing anywhere (i.e., it's NULL), leading to a crash or potentially exploitable behavior.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2025-05-30 14:39:02 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2265195, 2265196, 2265197 | ||
| Bug Blocks: | 2265193 | ||
|
Description
Patrick Del Bello
2024-02-20 20:47:27 UTC
This bug was discussed with the reporter by upstream developers and redhat secalert on Jan 9/10 (INC2833485). The conclusion then was that this was a normal bug and not a security issue. Crashes in the standalone utilities on untrustworthy inputs are not normally seen as security issues, because they don't cause privilege escalation. See our SECURITY policy at: https://sourceware.org/cgit/elfutils/tree/SECURITY Note that the description "a NULL pointer dereference via the handle_verdef() function at readelf.c" doesn't match what is shown in https://github.com/schsiung/fuzzer_issues/issues/1 Which is an integer overflow which is only triggered when building with the undefined sanitizer (ubsan), but doesn't impact non-instrumented code (the verdef is detected as bogus and not processed further) . Also note it doesn't match the upstream elfutils bug referenced: https://sourceware.org/bugzilla/show_bug.cgi?id=31058 Which is an issue that only triggers when the code is compiled with the address sanitizer (asan), otherwise the code might just print an random global string. Closing as this isn't a security issue according to the elfutils security policy: https://sourceware.org/cgit/elfutils/tree/SECURITY |