CVE-2017-7612
published 2017-04-09CVE-2017-7612: The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application…
PriorityP420medium5.5CVSS 3.0
AVLACLPRNUIRSUCNINAH
EPSS
1.75%
75.3th percentile
The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | elfutils | < elfutils 0.168-1 (bookworm) | elfutils 0.168-1 (bookworm) |
| elfutils_project | elfutils | — | — |
| elfutils_project | elfutils | >= 0 < 0.168-1 | 0.168-1 |
| elfutils_project | elfutils | >= 0 < 0.168-1 | 0.168-1 |
| elfutils_project | elfutils | >= 0 < 0.168-1 | 0.168-1 |
| elfutils_project | elfutils | >= 0 < 0.168-1 | 0.168-1 |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
elfutils vulnerabilities
vendor_ubuntu·2018-06-05
CVE-2016-10254 elfutils vulnerabilities
Title: elfutils vulnerabilities
Summary: elfutils could be made to crash or consume resources if it opened a
specially crafted file.
Agostino Sarubbo discovered that elfutils incorrectly handled certain
malformed ELF files. If a user or automated system were tricked into
processing a specially crafted ELF file, elfutils could be made to crash or
consume resources, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
elfutils: Heap-buffer overflow in the check_sysv_hash function
vendor_redhat·2017-04-04·CVSS 5.5
CVE-2017-7612 [MEDIUM] CWE-122 elfutils: Heap-buffer overflow in the check_sysv_hash function
elfutils: Heap-buffer overflow in the check_sysv_hash function
The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
Package: elfutils (Red Hat Enterprise Linux 5) - Will not fix
Package: elfutils (Red Hat Enterprise Linux 6) - Will not fix
Package: elfutils (Red Hat Enterprise Linux 7) - Will not fix
Debian
CVE-2017-7612: elfutils - The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attack...
vendor_debian·2017·CVSS 5.5
CVE-2017-7612 [MEDIUM] CVE-2017-7612: elfutils - The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attack...
The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
Scope: local
bookworm: resolved (fixed in 0.168-1)
bullseye: resolved (fixed in 0.168-1)
forky: resolved (fixed in 0.168-1)
sid: resolved (fixed in 0.168-1)
trixie: resolved (fixed in 0.168-1)
GHSA
GHSA-97hq-32mc-c642: The check_sysv_hash function in elflint
ghsa_unreviewed·2022-05-13
CVE-2017-7612 [MEDIUM] CWE-125 GHSA-97hq-32mc-c642: The check_sysv_hash function in elflint
The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
OSV
CVE-2017-7612: The check_sysv_hash function in elflint
osv·2017-04-09·CVSS 5.5
CVE-2017-7612 [MEDIUM] CVE-2017-7612: The check_sysv_hash function in elflint
The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
No detection rules found.
Exploit-DB
iOS/macOS - 'task_swap_mach_voucher()' Use-After-Free
exploitdb·2019-01-25·CVSS 7.8
CVE-2019-6225 [HIGH] iOS/macOS - 'task_swap_mach_voucher()' Use-After-Free
iOS/macOS - 'task_swap_mach_voucher()' Use-After-Free
---
/*
* voucher_swap-poc.c
* Brandon Azad
*/
#if 0
iOS/macOS: task_swap_mach_voucher() does not respect MIG semantics leading to use-after-free
The dangers of not obeying MIG semantics have been well documented: see issues 926 (CVE-2016-7612),
954 (CVE-2016-7633), 1417 (CVE-2017-13861, async_wake), 1520 (CVE-2018-4139), 1529 (CVE-2018-4206),
and 1629 (no CVE), as well as CVE-2018-4280 (blanket). However, despite numerous fixes and
mitigations, MIG issues persist and offer incredibly powerful exploit primitives. Part of the
problem is that MIG semantics are complicated and unintuitive and do not align well with the
kernel's abstractions.
Consider the MIG routine task_swap_mach_voucher():
routine task_swap_mach_voucher(
task : task_
Exploit-DB
Apple macOS/iOS - Kernel Double Free due to IOSurfaceRootUserClient not Respecting MIG Ownership Rules
exploitdb·2017-12-11·CVSS 7.8
CVE-2017-13861 [HIGH] Apple macOS/iOS - Kernel Double Free due to IOSurfaceRootUserClient not Respecting MIG Ownership Rules
Apple macOS/iOS - Kernel Double Free due to IOSurfaceRootUserClient not Respecting MIG Ownership Rules
---
I have previously detailed the lifetime management paradigms in MIG in the writeups for:
CVE-2016-7612 [https://bugs.chromium.org/p/project-zero/issues/detail?id=926]
and
CVE-2016-7633 [https://bugs.chromium.org/p/project-zero/issues/detail?id=954]
If a MIG method returns KERN_SUCCESS it means that the method took ownership of *all* the arguments passed to it.
If a MIG method returns an error code, then it took ownership of *none* of the arguments passed to it.
If an IOKit userclient external method takes an async wake mach port argument then the lifetime of the reference
on that mach port passed to the external method will be managed by MIG semantics. If the external method retur
Bugzilla
CVE-2017-7607 CVE-2017-7608 CVE-2017-7609 CVE-2017-7610 CVE-2017-7611 CVE-2017-7612 CVE-2017-7613 elfutils: various flaws [fedora-all]
bugzilla·2017-04-12·CVSS 5.5
CVE-2017-7607 [MEDIUM] CVE-2017-7607 CVE-2017-7608 CVE-2017-7609 CVE-2017-7610 CVE-2017-7611 CVE-2017-7612 CVE-2017-7613 elfutils: various flaws [fedora-all]
CVE-2017-7607 CVE-2017-7608 CVE-2017-7609 CVE-2017-7610 CVE-2017-7611 CVE-2017-7612 CVE-2017-7613 elfutils: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit messa
Bugzilla
CVE-2017-7612 elfutils: Heap-buffer overflow in the check_sysv_hash function
bugzilla·2017-04-12·CVSS 5.5
CVE-2017-7612 [MEDIUM] CVE-2017-7612 elfutils: Heap-buffer overflow in the check_sysv_hash function
CVE-2017-7612 elfutils: Heap-buffer overflow in the check_sysv_hash function
The check_sysv_hash function in elflint.c in elfutils allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
Upstream bug:
https://sourceware.org/bugzilla/show_bug.cgi?id=21311
Upstream patch:
https://sourceware.org/ml/elfutils-devel/2017-q1/msg00131.html
References:
https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_sysv_hash-elflint-c/
Discussion:
Created elfutils tracking bugs for this issue:
Affects: fedora-all [bug 1441630]
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.htmlhttps://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_sysv_hash-elflint-chttps://lists.debian.org/debian-lts-announce/2019/02/msg00036.htmlhttps://security.gentoo.org/glsa/201710-10https://usn.ubuntu.com/3670-1/http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.htmlhttps://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_sysv_hash-elflint-chttps://lists.debian.org/debian-lts-announce/2019/02/msg00036.htmlhttps://security.gentoo.org/glsa/201710-10https://usn.ubuntu.com/3670-1/
2017-04-09
Published