Log in Start free

Vulnerability · Published Feb 17, 2025 · Assigned by VulDB

CVE-2025-1377GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service

Low 3.3

In plain English

A low-severity security flaw in elfutils from GNU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.3%top 74.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12elfutilsno fix listedDEBIAN-CVE-2025-1377
Debian:13elfutilsno fix listedDEBIAN-CVE-2025-1377
Debian:14elfutilsno fix listedDEBIAN-CVE-2025-1377
Ubuntu:22.04:LTSelfutils0.186-1ubuntu0.1USN-7369-1
Ubuntu:22.04:LTSelfutils0.186-1ubuntu0.1UBUNTU-CVE-2025-1377
Ubuntu:24.04:LTSelfutils0.190-1.1ubuntu0.1USN-7369-1
Ubuntu:24.04:LTSelfutils0.190-1.1ubuntu0.1UBUNTU-CVE-2025-1377

Affected products (as reported)

VendorProductVersions
GNU elfutils 0.192

Weakness: CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References