CVE-2022-21711

Out-of-bounds Read lead to application crashes or information leakage in ELF parsing.

elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special format ELF file, the information of any address can be leaked. elfspirit version 1.1 contains a patch for this issue.

Affected

liyansong2018 · elfspirit

CVSS v3.1 NVD

7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

CVSS v2.0 NVD

5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:P

EPSS

0.88% chance of exploitation in the next 30 days, 58th percentile

Published

2022-01-24

Updated

2025-04-22

Proof-of-concept exploits (1)

• liyansong2018/elfspirit/issues/1145★ · 2026-08-12

Security advisories

• liyansong2018/elfspirit/security/advisories/GHSA-jr8h-2657-m68r

References

• CVE Record
• NVD entry

Related

• CVE-2021-29302
• CVE-2021-31658
• CVE-2021-31659
• CVE-2021-34201
• CVE-2021-34202
• CVE-2021-34203