Bug 1339929 (CVE-2016-5028) - CVE-2016-5028 libdwarf: Null pointer dereference in print_frame_inst_bytes()
Summary: CVE-2016-5028 libdwarf: Null pointer dereference in print_frame_inst_bytes()
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2016-5028
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1340128 1340129
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-05-26 08:29 UTC by Andrej Nemec
Modified: 2021-02-17 03:50 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2019-06-08 02:52:46 UTC
Embargoed:

Attachments (Terms of Use)

Description Andrej Nemec 2016-05-26 08:29:49 UTC 
A null pointer dereference vulnerability was found in libdwarf. It exists due to a corrupted object file. Libdwarf was not dealing with empty (bss-like) sections since it really did not expect to see such in sections it reads. Now libdwarf catches the object error so dwarfdump sees the section as empty.

References (with a link to PoC):

http://seclists.org/oss-sec/2016/q2/393

External references:

https://www.prevanders.net/dwarfbug.html

Upstream fix:

https://sourceforge.net/p/libdwarf/code/ci/a55b958926cc67f89a512ed30bb5a22b0adb10f4
Comment 1 Tom Hughes 2016-05-26 08:34:35 UTC 
If you want to report an issue with the Fedora package then please do so against the proper component.

In the meantime please stop adding me to your RedHat internal security bugs.
Comment 2 Andrej Nemec 2016-05-26 13:41:55 UTC 
Created libdwarf tracking bugs for this issue:

Affects: fedora-all [bug 1340128]
Affects: epel-6 [bug 1340129]
Note You need to log in before you can comment on or make changes to this bug.