This issue is this code in readelf.c (handle_core_item):

      {
        char printed[(negate ? nbits - pop : pop) * 16];
        char *p = printed;
        *p = '\0';

[...]

            unsigned int bit = ((void *) i - data) * 8;
            unsigned int w = negate ? ~*i : *i;
            while (w != 0)
              {
                int n = ffs (w);
                w >>= n;
                bit += n;

                if (lastbit != 0 && lastbit + 1 == bit)
                  ++run;
                else
                  {
                    if (lastbit == 0)
                      p += sprintf (p, "%u", bit - bias);
                    else if (run == 0)
                      p += sprintf (p, ",%u", bit - bias);
                    else
                      p += sprintf (p, "-%u,%u", lastbit - bias, bit - bias);
                    run = 0;
                  }

                lastbit = bit;
              }

One of the sprintf calls will overflow the p char array.

The problem is this:

  int n = ffs (w);
  w >>= n;

The intent is to shift away up to (and including) the first least significant bit in w. But w is a unsigned int, so 32 bits. And the least significant bit could be bit 32 (ffs counts from 1). Unfortunately a right shift equal to (or larger than) the length in bits of the left hand operand is undefined behaviour. We expect w to be zero afterwards. Which would terminate the while loop. But since it is undefined behaviour anything can happen. In this case, what will happen is that w is unchanged, causing an infinite loop...

gcc -fsanitize=undefined will catch and warn about this when w = 0x80000000

Upstream patch:
https://lists.fedorahosted.org/pipermail/elfutils-devel/2015-September/005118.html

elfutils-0.163-4.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15264

elfutils-0.163-4.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update elfutils'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15264

elfutils-0.163-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

elfutils-0.163-4.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-ba9ded92ef

elfutils-0.163-4.fc21 has been submitted as an update to Fedora 21. https://bodhi.fedoraproject.org/updates/FEDORA-2015-aabc904fe3

elfutils-0.163-4.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update elfutils'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-ba9ded92ef

elfutils-0.163-4.fc21 has been pushed to the Fedora 21 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update elfutils'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-aabc904fe3

elfutils-0.163-4.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

elfutils-0.163-4.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.