CVE-2021-33294

MediumCVSS 5.5

Published: 18/07/2023(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c, which allows attackers to cause a denial of service (infinite loop) via a crafted file.

Risk Assessment

Risk involves the possibility of causing DoS by supplying a specially crafted file, potentially leading to unavailability of tools based on elfutils.

Recommendation

Update elfutils to a version that fixes this infinite loop. Avoid processing untrusted binary files.

Other vulnerabilities in elfutils

CVE-2020-21047Medium
The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.

Original NVD description (English source)

In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS