Log in Start free

Vulnerability · Published Feb 16, 2025 · Assigned by VulDB

CVE-2025-1352GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption

Medium 5.0

In plain English

A medium-severity memory corruption in elfutils from GNU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.7%top 48.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12elfutilsno fix listedDEBIAN-CVE-2025-1352
Debian:13elfutilsno fix listedDEBIAN-CVE-2025-1352
Debian:14elfutilsno fix listedDEBIAN-CVE-2025-1352
Ubuntu:22.04:LTSelfutilsno fix listedUBUNTU-CVE-2025-1352
Ubuntu:24.04:LTSelfutilsno fix listedUBUNTU-CVE-2025-1352
Ubuntu:25.10elfutilsno fix listedUBUNTU-CVE-2025-1352
Ubuntu:26.10elfutilsno fix listedUBUNTU-CVE-2025-1352

Affected products (as reported)

VendorProductVersions
GNU elfutils 0.192

Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

References