CVE-2021-33294

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite loop) via crafted file.

*Credits: N/A

CVSS Scores

NISTv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

Poc

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2021-05-20 CVE Reserved
2023-07-18 CVE Published
2024-08-19 EPSS Updated
2024-10-28 CVE Updated
2024-10-28 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC
https://sourceware.org/bugzilla/show_bug.cgi?id=27501	2024-10-28

URL	Date	SRC
https://sourceware.org/pipermail/elfutils-devel/2021q1/003607.html	2023-07-27

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Elfutils Project Search vendor "Elfutils Project"		Elfutils Search vendor "Elfutils Project" for product "Elfutils"				0.183 Search vendor "Elfutils Project" for product "Elfutils" and version "0.183"		-		Affected