Описание
Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.
A heap-based buffer overflow vulnerability was found in binutils in the find_section_in_set function. This flaw allows an attacker to use a specially crafted payload to trigger a buffer overflow, resulting in issues with availability, confidentiality, and integrity.
Отчет
The issue is classified as low severity primarily because binutils is not typically exposed to untrusted inputs in our environments, limiting its exploitation potential. The buffer overflow in find_section_in_set() only triggers during the parsing of malformed ELF files, which would require an attacker to convince a user to process a malicious ELF file with readelf. Moreover, binutils does not handle privileged operations, meaning exploitation is unlikely to lead to system compromise or escalation of privileges. Additionally, the impact is localized to the application itself, without affecting the broader system or network security.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | binutils | Out of support scope | ||
| Red Hat Enterprise Linux 7 | binutils | Out of support scope | ||
| Red Hat Enterprise Linux 7 | gdb | Out of support scope | ||
| Red Hat Enterprise Linux 8 | binutils | Will not fix | ||
| Red Hat Enterprise Linux 8 | gcc-toolset-11-binutils | Fix deferred | ||
| Red Hat Enterprise Linux 8 | gcc-toolset-11-gdb | Not affected | ||
| Red Hat Enterprise Linux 8 | gcc-toolset-12-binutils | Fix deferred | ||
| Red Hat Enterprise Linux 8 | gcc-toolset-12-gdb | Not affected | ||
| Red Hat Enterprise Linux 8 | gcc-toolset-13-binutils | Fix deferred | ||
| Red Hat Enterprise Linux 8 | gcc-toolset-13-gdb | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.
Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.
Heap buffer overflow vulnerability in binutils readelf before 2.40 via ...
Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.
Уязвимость функции find_section_in_set() (readelf.c) программного средства разработки GNU Binutils, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
EPSS
7.8 High
CVSS3