Multiple vulnerabilities in GNU Binutils



| Updated: 2018-12-25
Risk Low
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2018-19931
CVE-2018-19932
CVE-2018-20002
CVE-2018-1000876
CWE-ID CWE-122
CWE-835
CWE-190
CWE-401
CWE-400
Exploitation vector Local
Public exploit Public exploit code for vulnerability #3 is available.
Public exploit code for vulnerability #4 is available.
Vulnerable software
 Binutils
Universal components / Libraries / Libraries used by multiple products

Vendor GNU

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Heap-based buffer overflow

EUVDB-ID: #VU16338

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-19931

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to heap-based buffer overflow in the bfd_elf32_swap_phdr_in function, as defined in the elfcode.h source code file when handling malicious input. A local attacker can supply a specially crafted file that may trigger memory corruption and cause the service to crash.

Mitigation

Update to version 2.31.1.

Vulnerable software versions

Binutils: 2.20.0 - 2.31

CPE2.3 External links

https://sourceware.org/bugzilla/show_bug.cgi?id=23942


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer overflow

EUVDB-ID: #VU16339

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-19932

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to integer overflow in the IS_CONTAINED_BY_LMAfunction, as defined in the elf.c source code file when handling malicious input. A local attacker can map a section to a segment, trigger an infinite loop condition, resulting in a DoS condition.

Mitigation

Update to version 2.31.1.

Vulnerable software versions

Binutils: 2.20.0 - 2.31

CPE2.3 External links

https://sourceware.org/bugzilla/show_bug.cgi?id=23932


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory leak

EUVDB-ID: #VU16344

Risk: Low

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2018-20002

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to memory leak in the _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils. A local attacker can send specially crafted ELF file, consume excessive resources and cause the service to crash.

Mitigation

Update to version 2.31.1.

Vulnerable software versions

Binutils: 2.31

CPE2.3 External links

https://sourceware.org/bugzilla/show_bug.cgi?id=23952


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Integer overflow

EUVDB-ID: #VU16695

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2018-1000876

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to integer overflow in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc. A local attacker can trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Binutils: 2.31 - 2.32

CPE2.3 External links

https://sourceware.org/bugzilla/show_bug.cgi?id=23994
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=3a551c7a1b80fca579461774860574eabfd7f18f


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###