CVE-2022-39170

A double-free vulnerability was found in libdwarf's dwarf_expand_frame_instructions() function of the dwarf_frame.c file. A carefully crafted object file could cause the ‘dwarfdump' utility to do a double free in handling an error condition. This issue could cause a segmentation violation or other major error, terminating the calling application and resulting in a denial of service.

The vulnerable code was introduced upstream in libdwarf-0.3.0, and later, Red Hat ships lower versions of libdwarf, which do not contain the vulnerable code. Hence, versions of libdwarf shipped with Red Hat Enterprise Linux 7 & 8 are not affected by this CVE.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.