Medium severity · published Feb 17, 2025
CVE-2025-1377
GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
elfutils · GNU
0.192 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1377
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1377
Exploit
https://sourceware.org/bugzilla/attachment.cgi?id=15941
Exploit
https://sourceware.org/bugzilla/show_bug.cgi?id=32673
Exploit
https://sourceware.org/bugzilla/show_bug.cgi?id=32673#c2
Permissions Required
https://vuldb.com/?ctiid.295985
Third Party Advisory
https://vuldb.com/?id.295985
Third Party Advisory
https://vuldb.com/?submit.497539
More from elfutils
7.8
CVE-2025-1372
GNU elfutils eu-readelf readelf.c print_string_section buffer overflow
7.8
CVE-2025-1365
GNU elfutils eu-readelf readelf.c process_symtab buffer overflow
7.5
CVE-2025-1352
GNU elfutils eu-readelf libdw_alloc.c __libdw_thread_tail memory corruption
5.5
CVE-2025-1371
GNU elfutils eu-read readelf.c handle_dynamic_symtab null pointer dereference
4.7
CVE-2025-1376
GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service