Critical Vulnerability in Binutils: Denial of Service Risk Due to NULL Pointer Dereference
Summary
UBUNTU-CVE-2017-13710: The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and applicat... Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Binutils is a collection of binary tools used for handling object files, archives, and binary executables. It provides essential functionalities for developers, including linking, assembling, and disassembling. The package is widely utilized in various software development environments, making its security paramount. This specific vulnerability affects versions of Binutils prior to 2.26.1-1ubuntu1~16.04.8+esm1, allowing attackers to exploit weaknesses in the Binary File Descriptor (BFD) library.
Vulnerability Detail
The vulnerability arises from the setup_group function in elf.c within the BFD library, as distributed in GNU Binutils 2.29. It allows remote attackers to trigger a denial of service by causing a NULL pointer dereference, leading to an application crash. This could potentially disrupt services relying on Binutils, affecting software development and deployment processes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider restricting access to the Binutils tools or disabling any services that utilize them until the package can be updated. This can help mitigate the risk of exploitation while a permanent fix is being implemented.
Conclusion
The vulnerability in Binutils poses a significant risk due to its potential to cause denial of service through a NULL pointer dereference. It is essential for users to update their packages to the patched version to safeguard their systems. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for binutils →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The vulnerability can lead to a denial of service, causing applications that rely on Binutils to crash, which may disrupt development workflows.
Yes, you can restrict access to Binutils tools or disable related services until the patch is applied.
Detailed information can be found in the Ubuntu security notices and the CVE database, specifically under CVE-2017-13710.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
