Skip to content
OpenAdvisories
Medium ALAS2-2023-2259 1 CVE

Moderate: elfutils security update (Amazon Linux 2)

Published Sep 13, 2023 · Updated Sep 20, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-21047: The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.

Fixed packages 9

ReleasePackageFixed in
Amazon Linux · 2 elfutils 0:0.176-2.amzn2.0.2
Amazon Linux · 2 elfutils-debuginfo 0:0.176-2.amzn2.0.2
Amazon Linux · 2 elfutils-default-yama-scope 0:0.176-2.amzn2.0.2
Amazon Linux · 2 elfutils-devel 0:0.176-2.amzn2.0.2
Amazon Linux · 2 elfutils-devel-static 0:0.176-2.amzn2.0.2
Amazon Linux · 2 elfutils-libelf 0:0.176-2.amzn2.0.2
Amazon Linux · 2 elfutils-libelf-devel 0:0.176-2.amzn2.0.2
Amazon Linux · 2 elfutils-libelf-devel-static 0:0.176-2.amzn2.0.2
Amazon Linux · 2 elfutils-libs 0:0.176-2.amzn2.0.2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-21047.html