{"id":"CVE-2020-21047","aliases":["DEBIAN-CVE-2020-21047","DLA-3579-1","EUVD-2020-13826","GHSA-q33x-5cf5-cqqv","UBUNTU-CVE-2020-21047","USN-6322-1"],"status":"published","title":"The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers...","description":"The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00251,"percentile":0.16625,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2023-08-22T00:00:00Z","modified":"2026-10-26T12:02:39Z","fixes":[{"ecosystem":"Debian:12","package":"elfutils","fixed_in":["0.180-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"elfutils","fixed_in":["0.180-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"elfutils","fixed_in":["0.180-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"elfutils","fixed_in":["0.176-1.1+deb10u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"elfutils","fixed_in":["0.158-0ubuntu5.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"elfutils","fixed_in":["0.165-3ubuntu1.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"elfutils","fixed_in":["0.170-0.4ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"elfutils","fixed_in":["0.176-1.1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"elfutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.180-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"elfutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.180-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"elfutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.180-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"elfutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.176-1.1+deb10u1"}]}],"versions":["0.176-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"elfutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.158-0ubuntu5.3+esm1"}]}],"versions":["0.157-1ubuntu1","0.158-0ubuntu3","0.158-0ubuntu4","0.158-0ubuntu5","0.158-0ubuntu5.1","0.158-0ubuntu5.2","0.158-0ubuntu5.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"elfutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.165-3ubuntu1.2+esm1"}]}],"versions":["0.163-4ubuntu1","0.163-5.1","0.164-1","0.165-3","0.165-3ubuntu1","0.165-3ubuntu1.1","0.165-3ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"elfutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.170-0.4ubuntu0.1+esm1"}]}],"versions":["0.170-0.1","0.170-0.2","0.170-0.3","0.170-0.4","0.170-0.4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"elfutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.176-1.1ubuntu0.1"}]}],"versions":["0.176-1.1","0.176-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"elfutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.158-0ubuntu5.3+esm1"}]}],"versions":["0.157-1ubuntu1","0.158-0ubuntu3","0.158-0ubuntu4","0.158-0ubuntu5","0.158-0ubuntu5.1","0.158-0ubuntu5.2","0.158-0ubuntu5.3"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"elfutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.165-3ubuntu1.2+esm1"}]}],"versions":["0.163-4ubuntu1","0.163-5.1","0.164-1","0.165-3","0.165-3ubuntu1","0.165-3ubuntu1.1","0.165-3ubuntu1.2"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"elfutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.170-0.4ubuntu0.1+esm1"}]}],"versions":["0.170-0.1","0.170-0.2","0.170-0.3","0.170-0.4","0.170-0.4ubuntu0.1"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"elfutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.176-1.1ubuntu0.1"}]}],"versions":["0.176-1.1","0.176-1.1build1"],"bundled":10}],"products":[{"vendor":"elfutils_project","product":"elfutils"},{"vendor":"siemens","product":"ruggedcom rox mx5000"},{"vendor":"siemens","product":"ruggedcom rox mx5000re"},{"vendor":"siemens","product":"ruggedcom rox rx1400"},{"vendor":"siemens","product":"ruggedcom rox rx1500"},{"vendor":"siemens","product":"ruggedcom rox rx1501"},{"vendor":"siemens","product":"ruggedcom rox rx1510"},{"vendor":"siemens","product":"ruggedcom rox rx1511"},{"vendor":"siemens","product":"ruggedcom rox rx1512"},{"vendor":"siemens","product":"ruggedcom rox rx1524"},{"vendor":"siemens","product":"ruggedcom rox rx1536"},{"vendor":"siemens","product":"ruggedcom rox rx5000"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=25068","tags":["x_transferred","Issue Tracking","report"]},{"url":"https://sourceware.org/git/?p=elfutils.git%3Ba=commitdiff%3Bh=99dc63b10b3878616b85df2dfd2e4e7103e414b8","tags":["x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00026.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-202008.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-21047"},{"url":"https://sourceware.org/git/?p=elfutils.git;a=commitdiff;h=99dc63b10b3878616b85df2dfd2e4e7103e414b8","tags":["report"]},{"url":"https://github.com/advisories/GHSA-q33x-5cf5-cqqv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-21047","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-21047","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6322-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-21047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33294","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-21047","description":"The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2026-10-14T09:35:15.997Z","updated_at":"2026-11-02T14:35:48.854892Z"}],"euvd":[{"id":"EUVD-2020-13826","description":"The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.","status":"published","published":"2023-08-22T00:00:00Z","modified":"2026-10-14T09:35:15Z","updated_at":"2026-11-02T17:27:16.85534Z"}],"ghsa":[{"id":"GHSA-q33x-5cf5-cqqv","title":"The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers...","description":"The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.","status":"published","published":"2023-08-22T21:30:25Z","modified":"2026-10-14T12:32:32Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:13:24.812204Z"}],"nvd":[{"id":"CVE-2020-21047","description":"The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.","status":"published","published":"2023-08-22T19:16:09.657Z","modified":"2026-10-14T10:17:31.97Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:47.910346Z"}],"osv":[{"id":"CVE-2020-21047","description":"The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.","status":"published","published":"2023-08-22T19:16:09.657Z","modified":"2026-10-24T10:30:25.99438502Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:15.212689Z"},{"id":"DEBIAN-CVE-2020-21047","description":"The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.","status":"published","published":"2023-08-22T19:16:09.657Z","modified":"2026-10-26T12:02:39.399270272Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-21047","description":"The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.","status":"published","published":"2023-08-22T19:16:00Z","modified":"2026-04-22T12:33:21.297586Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"DLA-3579-1","title":"elfutils - security update","status":"published","published":"2023-09-23T00:00:00Z","modified":"2026-03-09T01:21:28.250832Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"USN-6322-1","title":"elfutils vulnerabilities","description":"It was discovered that elfutils incorrectly handled certain malformed\nfiles. If a user or automated system were tricked into processing a\nspecially crafted file, elfutils could be made to crash or consume\nresources, resulting in a denial of service. This issue only affected\nUbuntu 14.04 LTS. (CVE-2018-16062, CVE-2018-16403, CVE-2018-18310,\nCVE-2018-18520, CVE-2018-18521, CVE-2019-7149, CVE-2019-7150,\nCVE-2019-7665)\n\nIt was discovered that elfutils incorrectly handled bounds checks in\ncertain functions when processing malformed files. If a user or automated\nsystem were tricked into processing a specially crafted file, elfutils\ncould be made to crash or consume resources, resulting in a denial of\nservice. (CVE-2020-21047, CVE-2021-33294)\n","status":"published","published":"2023-08-30T16:29:23Z","modified":"2026-06-29T13:50:56.403690177Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}