Cloudanix VulnDB

CVE-2024-2002

High · 7.5

CVSS

7.5

EPSS

1.1%

Published

Mar 18, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in a library that reads debugging information can make programs crash or behave unpredictably when given specially crafted files.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double-free vulnerability in libdwarf allowing the same heap allocation to be deallocated twice when parsing a multiply-corrupted DWARF object, resulting in memory corruption and unpredictable program behavior including crashes.

Why it matters to the business

Tools and applications that rely on libdwarf for processing debugging information may experience sudden failures or instability when handling malformed input files, disrupting development, debugging, and crash analysis workflows across affected systems.

How an attack unfolds

An attacker creates or obtains a multiply-corrupted DWARF object and supplies it as input to any application linked against the vulnerable libdwarf library; during object parsing the library attempts to free the same allocation twice, triggering memory corruption.

How to fix it

Upgrade crash and crash-devel packages on AlmaLinux 8 to version 7.3.0-2.el8.alma; update davea42/libdwarf-code to commit 5e43a5ab73cb00c8a46660b361366a8c9c3c93c9 or later.

How to confirm the fix worked

Confirm installed package versions match the listed fixed releases or verify the source repository contains the referenced commit; test parsing of known-corrupted DWARF test cases to ensure no double-free occurs.

Typical attack path

  1. Obtain or craft a multiply-corrupted DWARF object file
  2. Supply the file as input to a vulnerable application or library consumer
  3. Trigger DWARF parsing to execute the double-free path
  4. Observe resulting memory corruption or application crash

How to detect it

Review application and system logs for crashes or memory errors occurring during DWARF file parsing; correlate with file inputs containing debugging sections from untrusted sources.

What your security team should do

  • Apply the listed package and commit updates immediately on all systems using libdwarf or crash
  • Restrict processing of untrusted or externally sourced DWARF objects until patches are deployed
  • Monitor application crash logs for memory-related failures involving libdwarf

The record

A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 dwarfutils 0 No fix
Debian:12 dwarfutils 0 No fix
Debian:13 dwarfutils 0 No fix
Debian:13 dwarfutils 0 1:0.11.1-1
Ubuntu:20.04:LTS dwarfutils 0 No fix
Ubuntu:22.04:LTS dwarfutils 0 No fix
Ubuntu:24.04:LTS dwarfutils 0 No fix
Ubuntu:24.10 dwarfutils 0 No fix
Ubuntu:25.04 dwarfutils 0 No fix
Ubuntu:Pro:16.04:LTS dwarfutils 0 No fix
Ubuntu:Pro:18.04:LTS dwarfutils 0 No fix

Related vulnerabilities