Critical Vulnerability in Binutils Package: Denial of Service Risk via Crafted ELF Files
Summary
UBUNTU-CVE-2018-17358: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Binutils package is a collection of binary tools essential for managing binary files, including object files, archives, and executable files. It provides functionalities such as linking, assembling, and disassembling. This package is widely used in various development environments, making it crucial for system stability and security. The vulnerability in question affects the Binary File Descriptor (BFD) library within Binutils, which is responsible for handling binary file formats.
Vulnerability Detail
An issue was discovered in the Binary File Descriptor (BFD) library, as distributed in GNU Binutils 2.31. An invalid memory access exists in the function _bfd_stab_section_find_nearest_line in syms.c. Attackers could exploit this vulnerability to cause a denial of service (application crash) by providing a crafted ELF file. The vulnerability has a CVSS score of 5.5, indicating a moderate level of risk that could lead to significant disruptions in service if exploited.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid processing untrusted ELF files until the package is updated. Additionally, implementing strict file validation can help mitigate the risk of exploitation.
Conclusion
The vulnerability in the Binutils package poses a significant risk of denial of service through crafted ELF files. It is crucial to update to the patched version to mitigate this risk. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for binutils →
FAQ
Binutils is a collection of tools for managing binary files, including object files and executables, essential for software development.
The vulnerability allows attackers to cause a denial of service by exploiting an invalid memory access in the BFD library when processing crafted ELF files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score of this vulnerability is 5.5, indicating a moderate risk level.
If an immediate update is not possible, avoid processing untrusted ELF files and implement strict file validation as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
