Bug 2564786

Summary:	CVE-2026-116732 libdwarf: libdwarf: Denial of Service via out-of-bounds read in dwarf_debug_addr_table [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Vladimir Vasilev <vvasilev>
Component:	libdwarf	Assignee:	Tom Hughes <tom>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	epel-packagers-sig, fedora, michel, orion, tom
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["ba500b05-27e4-49a8-afb4-aa38a6ff9779"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2561463

Description Vladimir Vasilev 2026-11-02 09:48:09 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.

Comment 1 Christoph Erhardt 2026-11-02 22:02:24 UTC

Fedora ships release 2.3.1, which is vulnerable according to the CVE record. The latest upstream release is 2.3.3; it is vulnerable as well.

Relevant links from the CVE record:
1. Upstream fix - https://github.com/davea42/libdwarf-code/commit/71f04013ddc2a3c88b9e25a4162ee2824741b593
2. Upstream issue - https://github.com/davea42/libdwarf-code/issues/336

The patch applies cleanly to versions 2.3.1 (rawhide, f45, f44), 2.2.0 (epel10) and 2.1.0 (f43), but not to 0.3.4 (epel9).

Comment 2 Tom Hughes 2026-11-02 22:08:09 UTC

Actually Fedora ships 2.3.3 in Fedora 45, or will do tomorrow.

As and when there is an upstream version which fixes this bug it will be shipped and this bug will be closed.

Comment 3 Tom Hughes 2026-11-02 22:09:57 UTC

Apologies it looks like I accidentally built 2.3.3 for F44 rather than F45 when it came out. I'll fix that now.

Comment 4 Christoph Erhardt 2026-11-02 22:15:36 UTC

Thanks! I have a commit ready that applies the bugfix as a patch. Would you be interested in pull requests against rawhide, f45, f44 and f43 so users get the fix early?

Comment 5 Tom Hughes 2026-11-02 22:17:28 UTC

Only if there's a very good reason and I wouldn't normally expect libdwarf to be used in security critical places.

Comment 6 Tom Hughes 2026-11-02 22:18:03 UTC

If upstream thought it was important they would presumably do a release anyway.

Comment 7 Christoph Erhardt 2026-11-02 22:27:28 UTC

According to the Red Hat advisory, local user interaction is required and exploitation can result in denial of service or information disclosure but not arbitrary code execution or data modification. Under these circumstances the fix is probably not exceedingly urgent.

Comment 8 Christoph Erhardt 2026-11-02 22:31:28 UTC

We should, however, make sure all supported Fedora versions get the new release once it's out. (I'd volunteer to take care of EPEL.)

Comment 9 Tom Hughes 2026-11-02 22:35:24 UTC

The upstream ticket seemed to say there was no exploit developed when I looked? Is that RedHat statement based on fact or just a guess based on the type of issue involved?

General Fedora policy is not to updated released version indiscriminatingly although obviously if there are important security issues that an update would be appropriate.