Heap-Based Buffer Over-Read in Binutils: CVE-2018-18605
Summary
UBUNTU-CVE-2018-18605: A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because _bfd_add_merge_se... Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Binutils is a collection of binary tools that are essential for managing binary files, including object files, archives, and executable files. It provides functionalities such as linking, assembling, and disassembling. The package is widely used in various development environments and is critical for compiling software. However, a vulnerability has been identified in the Binary File Descriptor (BFD) library, which is part of Binutils, exposing it to potential attacks.
Vulnerability Detail
A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library, as distributed in GNU Binutils 2.31. The vulnerability arises because _bfd_add_merge_section mishandles section merges when the size is not a multiple of entsize. This flaw allows remote attackers to craft a specially designed ELF file that can lead to a denial of service, potentially crashing the application or causing unexpected behavior.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid processing untrusted ELF files until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The CVE-2018-18605 vulnerability in the Binutils package poses a significant risk due to its potential for denial of service attacks. It is crucial to update to the patched versions of the package to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for binutils →
FAQ
CVE-2018-18605 is a vulnerability in the Binutils package that allows for a heap-based buffer over-read, potentially leading to denial of service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Exploiting this vulnerability can lead to a denial of service, causing applications to crash or behave unexpectedly.
Yes, patched versions of the Binutils package are available for various Ubuntu distributions. Ensure you update to the latest version.
If an immediate update is not possible, refrain from processing untrusted ELF files to minimize the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
