Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-39170: A double-free vulnerability was found in libdwarf's dwarf_expand_frame_instructions() function of the dwarf_frame.c file. A carefully crafted object file could cause the 'dwarfdump' utility to do a double free in handling an error condition. This issue could cause a segmentation violation or other major error, terminating the calling application and resulting in a denial of service.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libdwarf | 1:0.5.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | libdwarf-debuginfo | 1:0.5.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | libdwarf-debugsource | 1:0.5.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | libdwarf-devel | 1:0.5.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | libdwarf-static | 1:0.5.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | libdwarf-tools | 1:0.5.0-1.amzn2023.0.2 |
| Amazon Linux · 2023 | libdwarf-tools-debuginfo | 1:0.5.0-1.amzn2023.0.2 |
Vulnerabilities 1
-
Unscored —
libdwarf 0.4.1 has a double free in _dwarf_exec_frame_instr in dwarf_frame.c.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-39170.html