Local Access Control Vulnerability in Binutils Package
Summary
UBUNTU-CVE-2024-57360: https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Binutils package is a collection of binary tools essential for managing binary files, including object files, archives, and executable files. It provides functionalities such as linking, assembling, and disassembling, making it a crucial component for developers and system administrators. The package is widely used in various Linux distributions, including Ubuntu, and is integral for software development and system maintenance. However, it has been identified that certain versions of Binutils are vulnerable to a local access control issue, specifically in the nm --without-symbol-version function.
Vulnerability Detail
The vulnerability, identified as CVE-2024-57360, arises from incorrect access control in the Binutils package, particularly affecting the nm command. This flaw allows local users to exploit the system by bypassing intended access restrictions, potentially leading to unauthorized access to sensitive information or system resources. The vulnerability scores a CVSS of 5.5, indicating a medium severity level, and can be exploited locally without requiring elevated privileges. The issue is rooted in the way the nm function handles symbol versions, which can be manipulated by an attacker to gain unintended access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the nm command by modifying file permissions or using access control lists (ACLs) to limit its usage to trusted users only. This can be done using the following command:
sudo chmod 700 /usr/bin/nm
This command restricts access to the nm command, allowing only the owner to execute it.
Conclusion
The Binutils package is essential for various binary management tasks in Linux environments. However, the identified vulnerability (CVE-2024-57360) poses a risk to local systems, allowing unauthorized access through the nm command. It is crucial to update to the patched version of the package to mitigate this risk. Users can also implement temporary workarounds to secure their systems until an update can be applied.
See every vulnerability recorded for binutils →
FAQ
CVE-2024-57360 is a vulnerability in the Binutils package that allows local users to bypass access controls in the nm command, potentially leading to unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
You can update the Binutils package by running the commands: sudo apt-get update followed by sudo apt-get install binutils.
If you cannot update the package immediately, consider restricting access to the nm command using file permissions or ACLs as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
