PT-2017-4305 · Gnu+1 · Gnu Binutils+1

Agostino Sarubbo

·

Publicado

2017-09-25

·

Atualizado

2021-07-21

·

CVE-2017-15022

CVSS v2.0

7.8

Alta

VetorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29
Description: The issue is related to the dwarf2.c component in the Binary File Descriptor (BFD) library, which does not validate the DW AT name data type. This allows remote attackers to cause a denial of service via a crafted ELF file, potentially resulting in a NULL pointer dereference, out-of-bounds access, or application crash. The exploitation is related to the scan unit for symbols and parse comp unit functions.
Recommendations: For GNU Binutils version 2.29, consider updating to a newer version that addresses this issue. As a temporary workaround, restrict the use of the dwarf2.c component or avoid processing untrusted ELF files until a patch is available.

Correção

DoS

NULL Pointer Dereference

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

BDU:2023-07760
CVE-2017-15022
MGASA-2019-0169
USN-4336-2

Produtos afetados

Gnu Binutils
Ubuntu