CVE-2024-2002

A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2024-2002	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2267700	Issue Tracking
https://github.com/davea42/libdwarf-code/blob/main/bugxml/data.txt	Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-2002	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2267700	Issue Tracking
https://github.com/davea42/libdwarf-code/blob/main/bugxml/data.txt	Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGPVLSPIXR32J6FOAFTTIMYTUUXJICGW/	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:libdwarf_project:libdwarf:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*

Configuration 3 (hide)

cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

History

09 Apr 2025, 15:36

Type	Values Removed	Values Added
First Time		Redhat Libdwarf Project libdwarf Fedoraproject Libdwarf Project Fedoraproject fedora Redhat enterprise Linux
CPE		cpe:2.3:a:libdwarf_project:libdwarf:::::::: cpe:2.3:o:fedoraproject:fedora:40:::::::* cpe:2.3:o:redhat:enterprise_linux:7.0:::::::* cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
References	~~() https://access.redhat.com/security/cve/CVE-2024-2002 -~~	() https://access.redhat.com/security/cve/CVE-2024-2002 - Third Party Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2267700 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2267700 - Issue Tracking
References	~~() https://github.com/davea42/libdwarf-code/blob/main/bugxml/data.txt -~~	() https://github.com/davea42/libdwarf-code/blob/main/bugxml/data.txt - Third Party Advisory
References	~~() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGPVLSPIXR32J6FOAFTTIMYTUUXJICGW/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGPVLSPIXR32J6FOAFTTIMYTUUXJICGW/ - Mailing List

21 Nov 2024, 09:08

Type	Values Removed	Values Added
References		() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGPVLSPIXR32J6FOAFTTIMYTUUXJICGW/ -
References	~~() https://access.redhat.com/security/cve/CVE-2024-2002 -~~	() https://access.redhat.com/security/cve/CVE-2024-2002 -
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2267700 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2267700 -
References	~~() https://github.com/davea42/libdwarf-code/blob/main/bugxml/data.txt -~~	() https://github.com/davea42/libdwarf-code/blob/main/bugxml/data.txt -

28 Sep 2024, 03:15

Type	Values Removed	Values Added
References	~~{'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGPVLSPIXR32J6FOAFTTIMYTUUXJICGW/', 'source': 'secalert@redhat.com'}~~

19 Apr 2024, 23:15

Type	Values Removed	Values Added
References		() https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGPVLSPIXR32J6FOAFTTIMYTUUXJICGW/ -
Summary		(es) Se encontró una vulnerabilidad de doble liberación en libdwarf. En un objeto DWARF multicorrupto, libdwarf puede intentar desasignar (liberar) una asignación dos veces, lo que podría provocar resultados diversos e impredecibles.

18 Mar 2024, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-18 13:15

Updated : 2025-04-09 15:36

NVD link : CVE-2024-2002

Mitre link : CVE-2024-2002

CVE.ORG link : CVE-2024-2002

JSON object : View

Products Affected

libdwarf_project

libdwarf

redhat

enterprise_linux

fedoraproject

fedora

CWE

CWE-415

Double Free

{"id": "CVE-2024-2002", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-03-18T13:15:07.657", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2024-2002", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2267700", "tags": ["Issue Tracking"], "source": "secalert@redhat.com"}, {"url": "https://github.com/davea42/libdwarf-code/blob/main/bugxml/data.txt", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-2002", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2267700", "tags": ["Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/davea42/libdwarf-code/blob/main/bugxml/data.txt", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGPVLSPIXR32J6FOAFTTIMYTUUXJICGW/", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-415"}]}], "descriptions": [{"lang": "en", "value": "A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad de doble liberaci\u00f3n en libdwarf. En un objeto DWARF multicorrupto, libdwarf puede intentar desasignar (liberar) una asignaci\u00f3n dos veces, lo que podr\u00eda provocar resultados diversos e impredecibles."}], "lastModified": "2025-04-09T15:36:37.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libdwarf_project:libdwarf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E3517E3-6D61-4C81-A11A-D7A4C48CE19E", "versionEndExcluding": "0.9.2", "versionStartIncluding": "0.1.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA277A6C-83EC-4536-9125-97B84C4FAF59"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}

7.5 /10