Is CVE-2022-38497 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-38497 being exploited in the wild.

How severe is CVE-2022-38497?

Low severity, with a CVSS score of 3.1, published 13 September 2022.

Which products and versions are affected?

lief (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.1, ECOSYSTEM:introduced=0,last_affected=0.12.1.

Is there a fix for CVE-2022-38497?

Yes. lief (PyPI): upgrade to 0.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-38497 attacked?

It is attacked with local access.

Am I affected by CVE-2022-38497?

Check whether you run lief (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-38497: PYSEC-2022-277 - LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69.

CVE-2022-38497 · Severity: low · CVSS 3.1 · Published 2022-09-13

LIEF is a library for parsing and manipulating executable file formats. A null pointer dereference in the ELF core file parsing component can cause the application to crash when processing malformed or specially crafted ELF files, leading to denial of service for any tool or service that uses LIEF to analyze binaries.

Technologies: lief (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-38497 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-38497 being exploited in the wild.
How severe is CVE-2022-38497?: Low severity, with a CVSS score of 3.1, published 13 September 2022.
Which products and versions are affected?: lief (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.1, ECOSYSTEM:introduced=0,last_affected=0.12.1.
Is there a fix for CVE-2022-38497?: Yes. lief (PyPI): upgrade to 0.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-38497 attacked?: It is attacked with local access.
Am I affected by CVE-2022-38497?: Check whether you run lief (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lief (PyPI): upgrade to 0.12.1 or later
```
pip install "lief>=0.12.1"
```

Technical details

LIEF contains a null pointer dereference (CWE-476) in CoreFile.tcc:69 when parsing ELF core files. The vulnerability occurs during the assignment of a string object in the CoreFile::parse_() template function, triggered by malformed ELF headers or missing program headers. An attacker can trigger a segmentation fault by providing a specially crafted ELF binary file. The vulnerability is reachable via file input with no authentication required, but requires user interaction (loading the malicious file). A patch is available in commit ca938740264f1fcb18f91cba8e4039c518ecb75b.

Affected products

LIEF LIEF 0.8.0 through 0.12.1

Identifiers

CVE-2022-38497
GHSA-2p5h-hpj4-fxgg
PYSEC-2022-277

Timeline

2022-09-14: disclosed
2022-09-20: patched: Fix available in commit ca938740264f1fcb18f91cba8e4039c518ecb75b

References

https://github.com/lief-project/LIEF/issues/766

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.