Heap-Based Buffer Overflow in Binutils Package - CVE-2021-20284
Summary
UBUNTU-CVE-2021-20284: A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. Affects binutils versions < 2.38-2ubuntu1. Fixed in 2.38-2ubuntu1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Binutils package is a collection of binary tools essential for the development and management of software on Unix-like operating systems. It includes tools for assembling, linking, and manipulating binary files. This package is crucial for developers as it provides the necessary utilities to handle object files and executable binaries. However, a vulnerability has been identified in version 2.35.1 of Binutils, which can lead to serious security issues if not addressed.
Vulnerability Detail
A flaw was discovered in GNU Binutils 2.35.1, specifically a heap-based buffer overflow in the function _bfd_elf_slurp_secondary_reloc_section located in elf.c. This vulnerability arises from incorrect calculations of the number of symbols, potentially allowing an attacker to exploit the overflow. The highest threat posed by this vulnerability is to system availability, which could lead to service disruptions or crashes.
How To Fix
Minimum fixed version
2.38-2ubuntu1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade binutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of the affected Binutils tools until the package is updated. It is advisable to avoid processing untrusted binary files that could exploit this vulnerability.
Conclusion
The vulnerability CVE-2021-20284 in the Binutils package presents a significant risk due to a heap-based buffer overflow. Users are encouraged to update their Binutils package to the patched version to ensure system security and stability. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for binutils →
FAQ
CVE-2021-20284 is a vulnerability in the Binutils package that can lead to a heap-based buffer overflow, potentially affecting system availability.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities without requiring installation.
The CVSS score for CVE-2021-20284 is 5.5, indicating a moderate level of severity.
The primary impact of this vulnerability is on system availability, which could lead to crashes or service disruptions if exploited.
Yes, a patched version of the Binutils package (2.38-2ubuntu1) is available. It is recommended to update to this version to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
