CVE-2024-2002 Libdwarf: crashes randomly on fuzzed object
A double-free vulnerability in libdwarf allows attackers to cause application crashes via corrupted DWARF objects, impacting systems using this library for binary analysis.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-2002?
CVE-2024-2002 is a high-severity use after free vulnerability in Fedoraproject Fedora, published on 18 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.
Weakness: CWE-415
Which versions are affected by CVE-2024-2002?
It affects 3 products.
Products include Fedoraproject Fedora, Libdwarf Project Libdwarf, Redhat Enterprise Linux.
How do I fix CVE-2024-2002?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-2002 being exploited?
There is no known exploitation of CVE-2024-2002 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-35908, AZL-42087, CVE-2024-31745, DEBIAN-CVE-2024-2002, GHSA-v5qg-55pp-x38m, OESA-2024-1343 and 6 more.