CVE-2024-42381

July 31, 2024, 12:57 p.m.

8.3
High

Description

os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary relocation phase, which occurs before a user would expect execution of downloaded package content. (237d1e783f7ee261beaba7d3f6bde22da7148b0a was the tested vulnerable version.)

Product(s) Impacted

Product Versions
Homebrew brew
  • ['before 4.2.20']

Weaknesses

Common security weaknesses mapped to this vulnerability.

References

https://blog.trailofbits.com/2024/07/30/our-audit-of-homebrew/
https://brew.sh/2024/07/30/homebrew-security-audit/
https://github.com/Homebrew/brew/commit/916b37388d3851a8a93a8e9b4adc38873680ead7
https://github.com/Homebrew/brew/pull/17136
https://github.com/Homebrew/brew/releases/tag/4.2.20
https://github.com/Homebrew/brew/tree/237d1e783f7ee261beaba7d3f6bde22da7148b0a
https://github.com/trailofbits/publications/blob/master/reviews/2023-08-28-homebrew-securityreview.pdf

Tags

cve@mitre.org
2024-07-31
CVE-2024-42381

CVSS Score

8.3 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: CHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

    View Vector String

Timeline

Published: July 31, 2024, 6:15 a.m.
Last Modified: July 31, 2024, 12:57 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.