CVE-2025-1377

low-risk
Published 2025-02-17

A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Elfutils Project

References (7)

Exploit https://sourceware.org/bugzilla/attachment.cgi?id=15941
Exploit https://sourceware.org/bugzilla/show_bug.cgi?id=32673
Exploit https://sourceware.org/bugzilla/show_bug.cgi?id=32673#c2
Permissions Required https://vuldb.com/?ctiid.295985
Third Party Advisory https://vuldb.com/?id.295985
Third Party Advisory https://vuldb.com/?submit.497539
Product https://www.gnu.org/
18
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal