Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read past the heap buffer, disclosing adjacent heap bytes or crashing consumers.
Fedora ships release 2.3.1, which is vulnerable according to the CVE record. The latest upstream release is 2.3.3; it is vulnerable as well. Relevant links from the CVE record: 1. Upstream fix - https://github.com/davea42/libdwarf-code/commit/71f04013ddc2a3c88b9e25a4162ee2824741b593 2. Upstream issue - https://github.com/davea42/libdwarf-code/issues/336 The patch applies cleanly to versions 2.3.1 (rawhide, f45, f44), 2.2.0 (epel10) and 2.1.0 (f43), but not to 0.3.4 (epel9).
Actually Fedora ships 2.3.3 in Fedora 45, or will do tomorrow. As and when there is an upstream version which fixes this bug it will be shipped and this bug will be closed.
Apologies it looks like I accidentally built 2.3.3 for F44 rather than F45 when it came out. I'll fix that now.
Thanks! I have a commit ready that applies the bugfix as a patch. Would you be interested in pull requests against rawhide, f45, f44 and f43 so users get the fix early?
Only if there's a very good reason and I wouldn't normally expect libdwarf to be used in security critical places.
If upstream thought it was important they would presumably do a release anyway.
According to the Red Hat advisory, local user interaction is required and exploitation can result in denial of service or information disclosure but not arbitrary code execution or data modification. Under these circumstances the fix is probably not exceedingly urgent.
We should, however, make sure all supported Fedora versions get the new release once it's out. (I'd volunteer to take care of EPEL.)
The upstream ticket seemed to say there was no exploit developed when I looked? Is that RedHat statement based on fact or just a guess based on the type of issue involved? General Fedora policy is not to updated released version indiscriminatingly although obviously if there are important security issues that an update would be appropriate.