Vulnerability · Published Jan 24, 2022 · Assigned by GitHub_M

CVE-2022-21711Out-of-bounds Read lead to application crashes or information leakage in ELF parsing.

High 7.1

In plain English

A high-severity out-of-bounds read in elfspirit from liyansong2018. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.9%top 40.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special format ELF file, the information of any address can be leaked. elfspirit version 1.1 contains a patch for this issue.

Affected products (as reported)

Vendor	Product	Versions
liyansong2018	elfspirit	< 1.1

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

References

https://github.com/liyansong2018/elfspirit/security/advisories/GHSA-jr8h-2657-m68r x_refsource_CONFIRM
https://github.com/liyansong2018/elfspirit/issues/1 x_refsource_MISC
https://github.com/liyansong2018/elfspirit/commit/c5b0f5a9a24f2451bbeda4751d67633bc375e608 x_refsource_MISC