CVE-2024-2002 — Double Free in Project Libdwarf

CWE-415 — Double FreeCWE-120 — Classic Buffer Overflow9 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 65.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Libdwarf Project LibdwarfFedoraproject FedoraRedhat Enterprise Linux
Timeline
PublishedMar 18
Latest updateAug 13

Description

A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDlibdwarf_project/libdwarf0.1.0 — 0.9.2

Also affects: Fedora 40, Enterprise Linux 7.0, 8.0

🔴Vulnerability Details

3
OSV
CVE-2024-2002: A double-free vulnerability was found in libdwarf↗2024-03-18
▶
CVEList
Libdwarf: crashes randomly on fuzzed object↗2024-03-18
▶
GHSA
GHSA-v5qg-55pp-x38m: A double-free vulnerability was found in libdwarf↗2024-03-18
▶

📋Vendor Advisories

4
Microsoft
Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on the local network to leak memory from four ↗2024-08-13
▶
Microsoft
Libdwarf: crashes randomly on fuzzed object↗2024-03-12
▶
Red Hat
libdwarf: crashes randomly on fuzzed object↗2024-02-17
▶
Debian
CVE-2024-2002: dwarfutils - A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF...↗2024
▶
CVE-2024-2002 — Double Free in Project Libdwarf | cvebase