CVE-2022-21711
elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.88%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special format ELF file, the information of any address can be leaked. elfspirit version 1.1 contains a patch for this issue.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- EPSS
- 0.88% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125
- Affected
- elfspirit project/elfspirit
- Source
- security-advisories@github.com
References
- https://github.com/liyansong2018/elfspirit/commit/c5b0f5a9a24f2451bbeda4751d67633bc375e608Patch, Third Party Advisory
- https://github.com/liyansong2018/elfspirit/issues/1Exploit, Issue Tracking, Third Party Advisory
- https://github.com/liyansong2018/elfspirit/security/advisories/GHSA-jr8h-2657-m68rPatch, Third Party Advisory
- https://github.com/liyansong2018/elfspirit/commit/c5b0f5a9a24f2451bbeda4751d67633bc375e608Patch, Third Party Advisory
- https://github.com/liyansong2018/elfspirit/issues/1Exploit, Issue Tracking, Third Party Advisory
- https://github.com/liyansong2018/elfspirit/security/advisories/GHSA-jr8h-2657-m68rPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.