Bugzilla – Bug 1200291
VUL-0: CVE-2022-32200: libdwarf: heap-based buffer over-read in _dwarf_check_string_valid in dwarf_util.c.
Last modified: 2024-04-19 11:20:00 UTC
CVE-2022-32200 libdwarf 0.4.0 has a heap-based buffer over-read in _dwarf_check_string_valid in dwarf_util.c. Upstream fix: https://github.com/davea42/libdwarf-code/commit/8151575a6ace77d005ca5bb5d71c1bfdba3f7069 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-32200 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32200 https://github.com/davea42/libdwarf-code/commit/8151575a6ace77d005ca5bb5d71c1bfdba3f7069 https://github.com/davea42/libdwarf-code/issues/116 https://www.prevanders.net/dwarfbug.html
@Michael I have a doubt here, is libdwarf still maintained?
SUSE codestreams are not affected. I only got an ASan crash on openSUSE:Factory.
I wouldn't really call it maintained. It got into SLE "just because", and it didn't see proper updates since 2017. That said, if you can show a problem I'm willing to ponder a backport (not a version update, though), for the SLE codestreams. For Factory it would be Dirk bugowning this thing.
(In reply to Michael Matz from comment #3) > I wouldn't really call it maintained. It got into SLE "just because", and > it didn't see proper updates since 2017. That said, if you can show a > problem I'm willing to ponder a backport (not a version update, though), for > the SLE codestreams. For Factory it would be Dirk bugowning this thing. Thanks for the explanations. For this bug particularly, nothing to do for SLE codestreams. Like for the other toolchain tools, it's very unlikely that we will get an RCE without user interaction, but we might get LTSS worthy bugs...
submitted to factory.
This is an autogenerated message for OBS integration: This bug (1200291) was mentioned in https://build.opensuse.org/request/show/981183 Factory / libdwarf
closing