CVE-2025-1377: elfutils_project elfutils Improper Resource Shutdown or Release
Vulnerability summary
CVE-2025-1377 is a medium (CVSS 5.5) Improper Resource Shutdown or Release vulnerability in elfutils_project elfutils. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.1% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 17-02-2025PublishedVulnerability first disclosed.
- 18-02-2025Last modifiedVulnerability information updated.
Description
A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue.
CVSS metrics
10 scores · 4 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVE.orgCNA3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST1.7LowAV:L/AC:L/Au:S/C:N/I:N/A:P
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
0.00 pp
From 0.33% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (sourceware.org)
Maturity: unknown
Exploit Reference (sourceware.org)
Maturity: unknown
Exploit Reference (sourceware.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- elfutilsAll versions (No fix recorded)
Elfutils_project1 product
- elfutils0.192
Gnu1 product
- elfutils0.192
Ubuntu1 product
- elfutils< 0.186-1ubuntu0.1 | < 0.190-1.1ubuntu0.1
4 vendors · 4 products
