CVE-2019-7148

An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted elf input, which leads to an out-of-memory exception. NOTE: The maintainers believe this is not a real issue, but instead a "warning caused by ASAN because the allocation is big. By setting ASAN_OPTIONS=allocator_may_return_null=1 and running the reproducer, nothing happens."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 73%
Affected Products (NVD)
VendorProductVersion
elfutils_projectelfutils
0.174
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
elfutils
bookworm
0.188-2.1
fixed
bullseye
0.183-1
fixed
sid
0.192-4
fixed
trixie
0.192-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
elfutils
bionic
ignored
cosmic
ignored
disco
not-affected
trusty
ignored
xenial
ignored
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
dwarves
suse enterprise desktop 15 SP3
1.22-150300.7.3.1
fixed
suse enterprise sap 15 SP3
1.22-150300.7.3.1
fixed
suse enterprise server 15 SP3
1.22-150300.7.3.1
fixed
elfutils
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise desktop 15 SP4
0.185-150400.3.35
fixed
suse enterprise desktop 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP4
0.185-150400.3.35
fixed
suse enterprise sap 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP4
0.185-150400.3.35
fixed
suse enterprise server 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP7
0.185-150400.5.3.1
fixed
elfutils-lang
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise desktop 15 SP4
0.185-150400.3.35
fixed
suse enterprise desktop 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP4
0.185-150400.3.35
fixed
suse enterprise sap 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP4
0.185-150400.3.35
fixed
suse enterprise server 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP7
0.185-150400.5.3.1
fixed
libasm-devel
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise desktop 15 SP4
0.185-150400.3.35
fixed
suse enterprise desktop 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP4
0.185-150400.3.35
fixed
suse enterprise sap 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP4
0.185-150400.3.35
fixed
suse enterprise server 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP7
0.185-150400.5.3.1
fixed
libasm1
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise desktop 15 SP4
0.185-150400.3.35
fixed
suse enterprise desktop 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP4
0.185-150400.3.35
fixed
suse enterprise sap 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP4
0.185-150400.3.35
fixed
suse enterprise server 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP7
0.185-150400.5.3.1
fixed
libdw-devel
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise desktop 15 SP4
0.185-150400.3.35
fixed
suse enterprise desktop 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP4
0.185-150400.3.35
fixed
suse enterprise sap 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP4
0.185-150400.3.35
fixed
suse enterprise server 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP7
0.185-150400.5.3.1
fixed
libdw1
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise desktop 15 SP4
0.185-150400.3.35
fixed
suse enterprise desktop 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP4
0.185-150400.3.35
fixed
suse enterprise sap 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP4
0.185-150400.3.35
fixed
suse enterprise server 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP7
0.185-150400.5.3.1
fixed
libdw1-32bit
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise desktop 15 SP4
0.185-150400.3.35
fixed
suse enterprise desktop 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP4
0.185-150400.3.35
fixed
suse enterprise sap 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP4
0.185-150400.3.35
fixed
suse enterprise server 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP7
0.185-150400.5.3.1
fixed
libdwarves-devel
suse enterprise desktop 15 SP3
1.22-150300.7.3.1
fixed
suse enterprise sap 15 SP3
1.22-150300.7.3.1
fixed
suse enterprise server 15 SP3
1.22-150300.7.3.1
fixed
libdwarves-devel-32bit
suse enterprise desktop 15 SP3
1.22-150300.7.3.1
fixed
suse enterprise sap 15 SP3
1.22-150300.7.3.1
fixed
suse enterprise server 15 SP3
1.22-150300.7.3.1
fixed
libdwarves1
suse enterprise desktop 15 SP3
1.22-150300.7.3.1
fixed
suse enterprise sap 15 SP3
1.22-150300.7.3.1
fixed
suse enterprise server 15 SP3
1.22-150300.7.3.1
fixed
libdwarves1-32bit
suse enterprise desktop 15 SP3
1.22-150300.7.3.1
fixed
suse enterprise sap 15 SP3
1.22-150300.7.3.1
fixed
suse enterprise server 15 SP3
1.22-150300.7.3.1
fixed
libebl-devel
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
libebl-plugins
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
libebl-plugins-32bit
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
libelf-devel
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise desktop 15 SP4
0.185-150400.3.35
fixed
suse enterprise desktop 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP4
0.185-150400.3.35
fixed
suse enterprise sap 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP4
0.185-150400.3.35
fixed
suse enterprise server 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP7
0.185-150400.5.3.1
fixed
libelf1
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise desktop 15 SP4
0.185-150400.3.35
fixed
suse enterprise desktop 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP4
0.185-150400.3.35
fixed
suse enterprise sap 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP4
0.185-150400.3.35
fixed
suse enterprise server 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP7
0.185-150400.5.3.1
fixed
libelf1-32bit
suse enterprise desktop 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise desktop 15 SP4
0.185-150400.3.35
fixed
suse enterprise desktop 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise desktop 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise sap 15 SP4
0.185-150400.3.35
fixed
suse enterprise sap 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise sap 15 SP7
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP3
0.177-150300.11.3.1
fixed
suse enterprise server 15 SP4
0.185-150400.3.35
fixed
suse enterprise server 15 SP5
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP6
0.185-150400.5.3.1
fixed
suse enterprise server 15 SP7
0.185-150400.5.3.1
fixed
Common Weakness Enumeration
References
https://sourceware.org/bugzilla/show_bug.cgi?id=24085
https://sourceware.org/bugzilla/show_bug.cgi?id=24085