Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-31745: Libdwarf v0.9.1 was discovered to contain a heap use-after-free via the dw_empty_errlist_item function at /libdwarf/dwarf_alloc.c. CVE-2024-2002: In a multiply-corrupted DWARF object libdwarf may try to dealloc(free) an allocation twice. Results are unpredictable and various. This has been a possibility since we added code to prevent leaks when generating 'unattached' Dwarf_Error records (where there is no Dwarf_Debug available at the point of error). The problem was introduced in libdwarf-0.1.0 in 2021.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libdwarf | 1:0.5.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | libdwarf-debuginfo | 1:0.5.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | libdwarf-debugsource | 1:0.5.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | libdwarf-devel | 1:0.5.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | libdwarf-static | 1:0.5.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | libdwarf-tools | 1:0.5.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | libdwarf-tools-debuginfo | 1:0.5.0-1.amzn2023.0.3 |
Vulnerabilities 2
-
High 7.5
Libdwarf: crashes randomly on fuzzed object
A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.
-
Unscored —CVE-2024-31745 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-2002. Reason: This candidate is a duplicate of CVE-2024-2002. No…