CVE-2022-21711

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-21711
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21711.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-21711
Aliases
  • GHSA-jr8h-2657-m68r
Published
2022-01-24T19:50:11Z
Modified
2026-03-14T11:27:22.300844Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVSS Calculator
Summary
Out-of-bounds Read lead to application crashes or information leakage in ELF parsing.
Details

elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special format ELF file, the information of any address can be leaked. elfspirit version 1.1 contains a patch for this issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21711.json"
}
References

Affected packages

Git / github.com/secnotes/elfspirit

Affected ranges

Type
GIT
Repo
https://github.com/secnotes/elfspirit
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c5b0f5a9a24f2451bbeda4751d67633bc375e608
Type
GIT
Repo
https://github.com/secnotes/elfspirit
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c5b0f5a9a24f2451bbeda4751d67633bc375e608

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "1.1.0"
            }
        ]
    }
]
vanir_signatures 
[
    {
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2022-21711-455e13a0",
        "target": {
            "file": "parse.c",
            "function": "parse"
        },
        "digest": {
            "length": 20347.0,
            "function_hash": "13297476286697402752728038289897875042"
        },
        "signature_version": "v1",
        "source": "https://github.com/secnotes/elfspirit/commit/c5b0f5a9a24f2451bbeda4751d67633bc375e608"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2022-21711-9da515a4",
        "target": {
            "file": "parse.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "142723406553885001538574251436819171427",
                "314981286411916668903367621138125752440",
                "47823681571075840447158482955025648812",
                "29925028637484309880610028003797679051",
                "80129800188348161244147279381942650935",
                "94169712119112277519225614323305749622",
                "186390820694764286033428915105386738174",
                "29925028637484309880610028003797679051",
                "80129800188348161244147279381942650935",
                "94169712119112277519225614323305749622",
                "186390820694764286033428915105386738174"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/secnotes/elfspirit/commit/c5b0f5a9a24f2451bbeda4751d67633bc375e608"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21711.json"