Cyber Resilience

CVE-2024-2002

High

Published: 18 March 2024

Published
18 March 2024
Modified
09 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0014 34.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-2002 is a high-severity Double Free (CWE-415) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 34.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.

CWE(s)
CWE-415

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Double-free vulnerability in libdwarf triggered by processing corrupted DWARF data in ELF objects enables application crashes or destabilization via exploitation, facilitating endpoint denial of service.

Affected Assets

libdwarf project
libdwarf
0.1.0 — 0.9.2
redhat
enterprise linux
7.0, 8.0
fedoraproject
fedora
40

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References