Skip to content
OpenAdvisories
Unscored CVE-2020-21047 EUVD-2020-13826GHSA-q33x-5cf5-cqqv

The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused …

Published Aug 22, 2023 · Updated Oct 14, 2026 · Assigned by mitre

Package: elfutils Package: elfutils Ecosystem: Debian Ecosystem: Ubuntu

Description

The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 elfutils 0.180-1 —
Debian 13 elfutils 0.180-1 —
Debian 12 elfutils 0.180-1 —
Debian 10 elfutils 0.176-1.1+deb10u1 DLA-3579-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS elfutils 0.176-1.1ubuntu0.1 USN-6322-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS elfutils 0.170-0.4ubuntu0.1+esm1 USN-6322-1
Ubuntu Pro 16.04 LTS elfutils 0.165-3ubuntu1.2+esm1 USN-6322-1
Ubuntu Pro 14.04 LTS elfutils 0.158-0ubuntu5.3+esm1 USN-6322-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 elfutils +7 0.176-2.amzn2.0.2 ALAS2-2023-2259

Advisories 7

References