CVE catalog

CVE-2020-21047

elfutils: CVE-2020-21047

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
Published: Aug 22, 2023, 7:16:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.25% · Oct 25, 2026

The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	elfutils	sid	`0.196-1`	fixed
Debian	elfutils	forky	`0.196-1`	fixed
Debian	elfutils	trixie	`0.192-4`	fixed
Debian	elfutils	bookworm	`0.188-2.1`	fixed
Cpe	elfutils	Not reported	Not reported	unknown
Ubuntu	elfutils	pro	`0.170-0.1`	vulnerable
Ubuntu	elfutils	pro	`0.170-0.2`	vulnerable
Ubuntu	elfutils	pro	`0.170-0.3`	vulnerable
Ubuntu	elfutils	pro	`0.170-0.4`	vulnerable
Ubuntu	elfutils	pro	`0.170-0.4ubuntu0.1`	vulnerable
Ubuntu	elfutils	pro	`0.170-0.4ubuntu0.1+esm1`	fixed
Ubuntu	elfutils	20.04	`0.176-1.1`	vulnerable
Ubuntu	elfutils	20.04	`0.176-1.1build1`	vulnerable
Ubuntu	elfutils	20.04	`0.176-1.1ubuntu0.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	elfutils	source	sid	`0.180-1`	not yet assigned	Not reported	Not reported
Debian	elfutils	source	forky	`0.180-1`	not yet assigned	Not reported	Not reported
Debian	elfutils	source	trixie	`0.180-1`	not yet assigned	Not reported	Not reported
Debian	elfutils	source	bookworm	`0.180-1`	not yet assigned	Not reported	Not reported
Ubuntu	elfutils	deb	pro	`0.170-0.4ubuntu0.1+esm1`	Not reported	UBUNTU-CVE-2020-21047	Not reported
Ubuntu	elfutils	deb	20.04	`0.176-1.1ubuntu0.1`	Not reported	UBUNTU-CVE-2020-21047	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[debuginfod]Unknown
Source package: [elfutils]
Details (4)
- 0.188-2.1 · amd64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.188-2.1 · arm64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
[elfutils]Unknown
Details (4)
- 0.188-2.1 · amd64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.188-2.1 · arm64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
[libasm1]Unknown
Source package: [elfutils]
Details (4)
- 0.188-2.1 · amd64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.188-2.1 · arm64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
[libasm-dev]Unknown
Source package: [elfutils]
Details (4)
- 0.188-2.1 · amd64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.188-2.1 · arm64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
[libdebuginfod1]Unknown
Source package: [elfutils]
Details (4)
- 0.188-2.1 · amd64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.188-2.1 · arm64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
[libdebuginfod-common]Unknown
Source package: [elfutils]
Details (4)
- 0.188-2.1 · all · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.188-2.1 · all · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
[libdebuginfod-dev]Unknown
Source package: [elfutils]
Details (4)
- 0.188-2.1 · amd64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.188-2.1 · arm64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
[libdw1]Unknown
Source package: [elfutils]
Details (4)
- 0.188-2.1 · amd64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.188-2.1 · arm64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
[libdw-dev]Unknown
Source package: [elfutils]
Details (4)
- 0.188-2.1 · amd64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.188-2.1 · arm64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
[libelf1]Unknown
Source package: [elfutils]
Details (4)
- 0.188-2.1 · amd64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.188-2.1 · arm64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
[libelf-dev]Unknown
Source package: [elfutils]
Details (4)
- 0.188-2.1 · amd64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.188-2.1 · arm64 · bookworm
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm
- 0.192-4~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.180-1
  dsa · elfutils · debian · bookworm

Observed: Oct 23, 2026, 5:48:57 PM UTC

References

[CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]