Denial of Service Vulnerability in Binutils Package: CVE-2018-17359
Summary
UBUNTU-CVE-2018-17359: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Binutils is a collection of binary tools essential for managing binary files, object files, and executable files in various programming environments. It provides functionalities such as linking, assembling, and disassembling. The package is widely used in software development and system programming, making its security critical. This vulnerability affects versions of Binutils that utilize the Binary File Descriptor (BFD) library, specifically versions 2.31 and earlier, which are susceptible to memory access issues.
Vulnerability Detail
An issue was discovered in the Binary File Descriptor (BFD) library, as distributed in GNU Binutils 2.31. An invalid memory access exists in the bfd_zalloc function located in opncls.c. This vulnerability can be exploited by attackers to cause a denial of service, leading to application crashes when processing crafted ELF files. The vulnerability is classified with a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted ELF files until the package is updated. Additionally, consider implementing input validation to mitigate the risk of exploitation.
Conclusion
The CVE-2018-17359 vulnerability in the Binutils package poses a risk of denial of service due to invalid memory access. Users are advised to update to the latest patched version to secure their systems. For those unable to update immediately, temporary workarounds should be employed to mitigate risks.
See every vulnerability recorded for binutils →
FAQ
CVE-2018-17359 is a vulnerability in the Binutils package that can lead to a denial of service due to an invalid memory access in the BFD library.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can cause application crashes when processing malicious ELF files, potentially disrupting services and affecting system stability.
Yes, a patched version of Binutils is available. Users should update to version 2.30-21ubuntu1~18.04.3 or later to mitigate the vulnerability.
If an immediate update is not possible, avoid processing untrusted ELF files and implement input validation as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
