CVE-2022-34299

A buffer-overflow vulnerability was found in libdwarf's dwarf_global_formref_b() function in dwarf_form.c. A carefully crafted .debug_info causes libdwarf to read outside a buffer containing a Dwarf_Sig8 symbolic reference. This issue can cause a segmentation violation or other major error, terminating the calling application and resulting in a denial of service.

The bug has been present since DWARF4 when DW_FORM_ref_sig8 was added to libdwarf. But, in our code-base, we cannot handle this functionality yet. There is no presence of vulnerable code in our code-base. Hence, versions of libdwarf shipped with Red Hat Enterprise Linux 7 & 8 are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.