CVE-2024-2002: 
NixOS vulnerability analysis and mitigation

A double-free vulnerability (CVE-2024-2002) was discovered in libdwarf, reported on March 18, 2024. When processing a multiply-corrupted DWARF object, libdwarf may attempt to deallocate (free) an allocation twice, potentially causing unpredictable results. This vulnerability was introduced in libdwarf-0.1.0 in 2021 (Red Hat CVE, Bugzilla).

The vulnerability is classified as a double-free issue (CWE-415) with a CVSS v3.1 base score of 7.5 (HIGH). The vulnerability affects the memory management functionality in libdwarf, specifically when handling corrupted DWARF debugging information. The issue occurs when processing malformed DWARF objects, where the library attempts to free the same memory allocation multiple times (Red Hat CVE).

The double-free vulnerability can lead to unpredictable behavior and various results when exploited. Given the CVSS score of 7.5 HIGH, the primary impact is on system availability, as indicated by the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (Red Hat CVE).

The vulnerability can be triggered by processing specially crafted DWARF objects. The CVSS vector string indicates that the vulnerability is network accessible (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N), and requires no user interaction (UI:N) (Red Hat CVE).

The vulnerability has been fixed in libdwarf version 0.9.2. Users are advised to upgrade to this version or later to address the security issue (Fedora Update).