Skip to content
OpenAdvisories
Medium · 5.5 CVE-2023-29935 EUVD-2023-33465GHSA-2wrh-j8p9-w4c5

llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.

Published May 5, 2023 · Updated Jan 29, 2025 · Assigned by mitre

Package: clang16 Package: llvm-toolchain-13 Package: llvm-toolchain-13 Package: llvm-toolchain-14 Package: llvm-toolchain-14 Package: llvm-toolchain-15 Package: llvm-toolchain-15 Package: rust Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 12 llvm-toolchain-13 +2 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 llvm-toolchain-14 No fix yet —
Ubuntu 24.04 LTS llvm-toolchain-14 +1 No fix yet —
Ubuntu 22.04 LTS llvm-toolchain-13 +2 No fix yet —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) clang16 16.0.0-2 —
Azure Linux 2 (CBL-Mariner) rust 1.72.0-1 —

References