TI-2025-01181 Aliases CVE-2025-1377 GHSA-grvw-8777-fhq7

GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service

LOW 22CWE-404Published 2025-02-17 · Updated 2025-02-18

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-404.

Summary

A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00326 25th percentileScored 2026-11-07

Public exploit Yes 3 exploit referencesTagged by NVD and the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GNU	elfutils	0.192	—	No fix listed	CNA

elfutils VendorGNU Affected 0.192 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:elfutils_project:elfutils:0.192:::::::*	0.192	Vulnerable	Elfutils Project

cpe:2.3:a:elfutils_project:elfutils:0.192:*:*:*:*:*:*:* Versions 0.192 Vulnerable ·Elfutils Project

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	—

Not affected: 4 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat OpenShift Container Platform 4

Timeline

2026-10-02 Threatist record created from CVE-2025-1377
2026-10-03 Alias added: GHSA-grvw-8777-fhq7
2026-11-06 Affected versions changed · Red Hat

References

Exploit 3

Other 1

https://www.gnu.org/

TI-2026-19388 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"… KEVCVSS 3.1CRITICAL 9.8
TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
TI-2014-05164 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… KEVCVSS 3.1HIGH 8.8
TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8

See all 1272 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences