Critical Vulnerability in Binutils: Member Access Within Null Pointer
Summary
ALPINE-CVE-2017-7614: elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a d... Affects binutils versions < 2.28-r1. Fixed in 2.28-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Binutils is a collection of binary tools that are essential for the development and management of binary files in various programming environments. It includes tools for assembling, linking, and manipulating binary files, making it a fundamental component in software development. The specific vulnerability in question affects the Binary File Descriptor (BFD) library within Binutils, which is responsible for handling binary file formats. This vulnerability can lead to severe consequences, including application crashes and potential exploitation by remote attackers.
Vulnerability Detail
The vulnerability, identified as CVE-2017-7614, originates from an issue in elflink.c within the BFD library of GNU Binutils 2.28. It involves undefined behavior due to member access within a null pointer, which can be exploited by attackers to cause a denial of service (application crash) or potentially lead to other unspecified impacts. The vulnerability is particularly concerning as it can be triggered by seemingly benign code, such as 'int main() {return 0;}', making it difficult to detect and mitigate.
How To Fix
Minimum fixed version
2.28-r1
This is the first release that contains the fix.
sudo apk add --upgrade binutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid executing potentially vulnerable binaries or refrain from using the affected features of Binutils until the package is updated. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The vulnerability CVE-2017-7614 in the Binutils package poses a significant risk due to its potential to cause application crashes and allow remote exploitation. It is crucial for users to update their Binutils package to the fixed version 2.28-r1 or later to mitigate this risk. Regular monitoring and updating of open-source components are essential for maintaining software security.
See every vulnerability recorded for binutils →
FAQ
CVE-2017-7614 is a critical vulnerability in the Binutils package that allows remote attackers to cause application crashes or other unspecified impacts due to member access within a null pointer.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2017-7614 is 9.8, indicating a critical level of severity.
The vulnerability can lead to application crashes and may allow remote attackers to exploit the system, potentially leading to further security breaches.
You can update Binutils to the patched version 2.28-r1 or later using the command: 'apk add binutils=2.28-r1' in Alpine Linux.
References
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
