Bug 2346059 (CVE-2025-1372)

Summary:	CVE-2025-1372 elfutils: GNU elfutils eu-readelf readelf.c print_string_section buffer overflow
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amerey, mjw
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in GNU elfutils. This vulnerability allows buffer overflow, potentially leading to arbitrary code execution or crashes via manipulation of the 'z/x' argument in the dump_data_section/print_string_section function of readelf.c.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-05-30 14:21:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2346225, 2346226
Bug Blocks:

Description OSIDB Bzimport 2025-02-17 04:01:17 UTC

A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue.

Comment 3 Mark Wielaard 2025-02-18 10:13:37 UTC

Note that this CVE was filed without following the upstream SECURITY policy:
https://sourceware.org/cgit/elfutils/tree/SECURITY
This is NOT a security issue according to upstream policy.
It was filed against GNU as vendor but elfutils is not a GNU package.

Upstream request that people who report suspected security vulnerabilities
report them through the contacts in the SECURITY policy and not through non-affiliated CNAs.