Integer Overflow and Application Crash in GNU Binutils 2.30
Summary
CVE-2018-7643: The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF... Affects binutils across 2 version ranges.
< 2.30-r2
< 8db5daf9efe8a6174d3b10ac7bba8c178836e9ce
Fixed in 2.30-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Binutils is a collection of binary tools used for creating, modifying, and analyzing object files. It includes utilities like objdump, which is used to display information about object files. The version 2.30 of GNU Binutils is affected by a vulnerability that can lead to an integer overflow and application crash when processing a specially crafted ELF file.
Vulnerability Detail
The vulnerability, identified as CVE-2018-7643, originates from the display_debug_ranges function in dwarf.c file of GNU Binutils. By exploiting this vulnerability, remote attackers can cause a denial of service by triggering an integer overflow and crashing the application. The impact of this vulnerability may extend beyond a simple crash, potentially leading to other unspecified consequences.
How To Fix
Minimum fixed version
2.30-r2
This is the first release that contains the fix.
sudo apk add --upgrade binutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The vulnerability in GNU Binutils 2.30 can result in an integer overflow and application crash. It is crucial to update the affected package to a fixed version to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for binutils →
FAQ
GNU Binutils is a collection of binary tools used for creating, modifying, and analyzing object files. It includes utilities like objdump, which is used to display information about object files.
The vulnerability can lead to a denial of service by causing an integer overflow and application crash. It may also have other unspecified impacts.
To fix this vulnerability in Alpine Linux, update the binutils package to version 2.30-r2 (for Alpine:v3.7) or 2.30-r6 (for Alpine:v3.8).
Other Linux distributions may also be affected if they are using GNU Binutils version 2.30. It is recommended to check the respective package repositories for the fixed version.
No workaround has been provided for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
