CVE-2024-42381 (CVSS 8.3)

Description

os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary relocation phase, which occurs before a user would expect execution of downloaded package content. (237d1e783f7ee261beaba7d3f6bde22da7148b0a was the tested vulnerable version.)

Is your site exposed to CVE-2024-42381?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.3

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness Type (CWE)

CWE-830 CWE-830

References

Other References

https://blog.trailofbits.com/2024/07/30/our-audit-of-homebrew/ https://brew.sh/2024/07/30/homebrew-security-audit/ https://github.com/Homebrew/brew/commit/916b37388d3851a8a93a8e9b4adc38873680ead7 https://github.com/Homebrew/brew/pull/17136 https://github.com/Homebrew/brew/releases/tag/4.2.20 https://github.com/Homebrew/brew/tree/237d1e783f7ee261beaba7d3f6bde22da7148b0a https://github.com/trailofbits/publications/blob/master/reviews/2023-08-28-homebrew-securityreview.pdf

Frequently Asked Questions

What is CVE-2024-42381? +

os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary relocation phase, which occurs before a user would expect execution of downloaded package content. (237d1e783f7ee261beaba7d3f6bde22da7148b0a was the tested vulnerable version.) It has a CVSS v3.1 base score of 8.3 (HIGH).

How severe is CVE-2024-42381? +

CVE-2024-42381 has a CVSS v3.1 score of 8.3 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

How do I check if I'm vulnerable to CVE-2024-42381? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-65109

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from …

CVE-2024-29944 8.4

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in …

CVE-2025-64496 7.3

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code …

CVE-2025-33028 6.1

In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. This vulnerability allows …

CVE-2025-43703 6.1

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the …

CVE-2025-46652 6.1

In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file …

CVE-2024-42381