Bug 2102019 (CVE-2022-34299) - CVE-2022-34299 libdwarf: heap buffer over-read in dwarf_global_formref_b() in dwarf_form.c
Summary: CVE-2022-34299 libdwarf: heap buffer over-read in dwarf_global_formref_b() in...
Keywords:
Status: NEW
Alias: CVE-2022-34299
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2102021
Blocks: 2100818
TreeView+ depends on / blocked
 
Reported: 2022-06-29 07:13 UTC by TEJ RATHI
Modified: 2023-07-07 08:34 UTC (History)
7 users (show)

Fixed In Version: libdwarf 0.4.1
Doc Type: If docs needed, set a value
Doc Text:
A buffer-overflow vulnerability was found in libdwarf's dwarf_global_formref_b() function in dwarf_form.c. A carefully crafted `.debug_info` causes libdwarf to read outside a buffer containing a Dwarf_Sig8 symbolic reference. This issue can cause a segmentation violation or other major error, terminating the calling application and resulting in a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description TEJ RATHI 2022-06-29 07:13:49 UTC 
There is a heap-based buffer over-read in libdwarf 0.4.0. This issue is related to dwarf_global_formref_b.

https://github.com/davea42/libdwarf-code/issues/119
https://github.com/davea42/libdwarf-code/commit/7ef09e1fc9ba07653dd078edb2408631c7969162
Comment 1 TEJ RATHI 2022-06-29 07:20:19 UTC 
Created libdwarf tracking bugs for this issue:

Affects: fedora-all [bug 2102021]
Note You need to log in before you can comment on or make changes to this bug.