Critical Vulnerability in Binutils: Multiple Out of Bound Reads Leading to Denial of Service
Summary
UBUNTU-CVE-2022-47673: An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts. Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Binutils is a collection of binary tools essential for managing binary files, object files, and executable files in Unix-like operating systems. It provides functionalities such as linking, assembling, and disassembling, making it a critical component for developers and system administrators. The vulnerability identified in Binutils affects its addr2line function, which is responsible for translating addresses into file names and line numbers. This vulnerability exposes systems to potential denial of service attacks, making it imperative for users to address it promptly.
Vulnerability Detail
An issue was discovered in Binutils addr2line before version 2.39.3, specifically in the function parse_module. This function contains multiple out-of-bounds reads, which can lead to a denial of service or other unspecified impacts. The vulnerability is classified with a CVSS score of 7.8, indicating a high severity level. Attackers could exploit this flaw to crash the application or execute arbitrary code, posing significant risks to system integrity and availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the addr2line function until the package is updated. Additionally, restricting access to the affected binaries can help mitigate potential exploitation.
Conclusion
The vulnerability in Binutils poses a significant risk due to its potential to cause denial of service and other impacts. Users are strongly encouraged to update to the latest patched versions to secure their systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring ongoing protection against threats.
See every vulnerability recorded for binutils →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to denial of service attacks, potentially crashing the application or allowing arbitrary code execution.
Yes, patched versions of Binutils are available. Users should update to at least version 2.30-21ubuntu1~18.04.9 or higher.
Binutils is used for managing binary files, object files, and executable files, providing essential tools for linking, assembling, and disassembling.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
