CVE-2020-21047
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.
Risk Assessment
An attacker can supply a crafted ELF file, causing application crashes and denial of service. This may disrupt tools analyzing ELF files or systems processing untrusted files.
Recommendation
Update elfutils to a version containing the fix for CVE-2020-21047. Avoid processing untrusted ELF files with vulnerable versions of elfutils.
Other vulnerabilities in elfutils
Original NVD description (English source)
The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS