Skip to content
OpenAdvisories
Unscored CVE-2019-7148 EUVD-2019-16698GHSA-67vc-2q9c-6854

An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Remote …

Published Jan 29, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Description

An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted elf input, which leads to an out-of-memory exception. NOTE: The maintainers believe this is not a real issue, but instead a "warning caused by ASAN because the allocation is big. By setting ASAN_OPTIONS=allocator_may_return_null=1 and running the reproducer, nothing happens."

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 elfutils 0.176-1 —
Debian 13 elfutils 0.176-1 —
Debian 12 elfutils 0.176-1 —
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS elfutils No fix yet —
Ubuntu Pro 16.04 LTS elfutils No fix yet —
Ubuntu Pro 14.04 LTS elfutils No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP3 dwarves 1.22-150300.7.3.1 SUSE-SU-2022:2614-1
SLES 15 SP3 elfutils 0.177-150300.11.3.1 SUSE-SU-2022:2614-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 5.2 dwarves 1.22-150300.7.3.1 SUSE-SU-2022:2614-1
SLE Micro 5.2 elfutils 0.177-150300.11.3.1 SUSE-SU-2022:2614-1
SLE Micro 5.1 dwarves 1.22-150300.7.3.1 SUSE-SU-2022:2614-1
SLE Micro 5.1 elfutils 0.177-150300.11.3.1 SUSE-SU-2022:2614-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.3 dwarves 1.22-150300.7.3.1 SUSE-SU-2022:2614-1
openSUSE Leap 15.3 elfutils 0.177-150300.11.3.1 SUSE-SU-2022:2614-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.2 dwarves 1.22-150300.7.3.1 SUSE-SU-2022:2614-2
openSUSE Leap Micro 5.2 elfutils 0.177-150300.11.3.1 SUSE-SU-2022:2614-2
ReleasePackageFixed inAdvisory
Alpine v3.24 elfutils 0.176-r0 —
Alpine v3.23 elfutils 0.176-r0 —
Alpine v3.22 elfutils 0.176-r0 —
Alpine v3.21 elfutils 0.176-r0 —
Alpine v3.20 elfutils 0.176-r0 —
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 elfutils 0.176-r0 —
Alpine v3.18 elfutils 0.176-r0 —
Alpine v3.17 elfutils 0.176-r0 —
Alpine v3.16 elfutils 0.176-r0 —
Alpine v3.15 elfutils 0.176-r0 —
Alpine v3.14 elfutils 0.176-r0 —
Alpine v3.13 elfutils 0.176-r0 —
Alpine v3.12 elfutils 0.176-r0 —

Advisories 2

References