CVE-2025-1371

What it actually does

Null pointer dereference in handle_dynamic_symtab within readelf.c of eu-read when processing malformed ELF dynamic symbol tables, causing a crash on local invocation.

Why it matters to the business

Local users or automated analysis tools can trigger application crashes, leading to denial of service for ELF inspection workflows and potential disruption of build or forensic pipelines that rely on the affected component.

How an attack unfolds

An attacker with local access crafts a specially malformed ELF binary containing a dynamic symbol table that triggers the null dereference path, then invokes the affected readelf functionality on the file to cause an immediate crash.

How to fix it

Upgrade to the fixed package versions: wireshark on Debian 11 to 3.4.16-0+deb11u1 and on Debian 13 to 4.2.5-1. Apply the upstream patch b38e562a4c907e08171c76b8b2def8464d5a104a where source rebuilds are required.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the listed fixed releases, then test that eu-read no longer crashes when given the originally reported malformed ELF sample.

Typical attack path

1. Obtain local access to a system with the vulnerable package installed
2. Construct or obtain a malicious ELF file engineered to exercise the handle_dynamic_symtab null dereference
3. Execute the eu-read / readelf tool against the crafted file
4. Observe process crash or abnormal termination

How to detect it

Review local process execution logs and core dumps for repeated crashes of readelf or eu-read processes; correlate with users or scripts that process untrusted ELF files.

What your security team should do

• Prioritize patching Debian systems running the listed wireshark packages within standard maintenance windows
• Inventory all systems using eu-read or dependent ELF analysis tools and schedule upgrades
• Restrict local execution of readelf utilities to trusted users until patches are deployed