CVE-2024-42381

Katalog CVE

CVSS 8.3 · High EPSS 0,65%

Kerentanan Inclusion of Web Functionality from an Untrusted Source. Skor CVSS 3.1 8.3 (High) menurut mitre.org.

Deskripsi (NVD)

os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary relocation phase, which occurs before a user would expect execution of downloaded package content. (237d1e783f7ee261beaba7d3f6bde22da7148b0a was the tested vulnerable version.)

Rincian

Terbit di NVD

31 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

8.3 (High), sumber mitre.org
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-830: Inclusion of Web Functionality from an Untrusted Source

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://blog.trailofbits.com/2024/07/30/our-audit-of-homebrew/
• https://brew.sh/2024/07/30/homebrew-security-audit/
• https://github.com/Homebrew/brew/commit/916b37388d3851a8a93a8e9b4adc38873680ead7
• https://github.com/Homebrew/brew/pull/17136
• https://github.com/Homebrew/brew/releases/tag/4.2.20
• https://github.com/Homebrew/brew/tree/237d1e783f7ee261beaba7d3f6bde22da7148b0a
• https://github.com/trailofbits/publications/blob/master/reviews/2023-08-28-homebrew-securityreview.pdf