PT-2019-6396 · Gnu+6 · Gnu Binutils+6

Zjuchenyuan · Publicado 2019-10-08 · Atualizado 2024-06-15 · CVE-2019-17450

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.32

Description The issue is related to the find abstract instance function in the dwarf2.c component of the BFD library, which is part of GNU Binutils. It allows remote attackers to cause a denial of service by triggering infinite recursion and application crash via a crafted ELF file. This is due to uncontrolled recursion in the find abstract instance function.

Recommendations For GNU Binutils version 2.32, consider avoiding the use of the find abstract instance function in the dwarf2.c component until a patch is available. As a temporary workaround, restrict the processing of crafted ELF files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

ALT-PU-2020-3352

ALT-PU-2020-3433

ALT-PU-2021-1230

BDU:2023-07808

CESA-2020_4465

CVE-2019-17450

MGASA-2020-0112

OPENSUSE-SU-2020:1790-1

OPENSUSE-SU-2020:1804-1

OPENSUSE-SU-2020_1790-1

OPENSUSE-SU-2020_1804-1

OPENSUSE-SU-2024:10651-1

RHSA-2020:4465

RHSA-2020_4465

SUSE-SU-2020:3060-1

SUSE-SU-2020:3552-1

SUSE-SU-2021:3593-1

USN-4336-1

USN-4336-2

Produtos afetados

Alt Linux

Astra Linux

Centos

Gnu Binutils

Red Hat

Suse

Ubuntu

Referências · 661

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=25078 · Exploit
• https://suse.com/security/cve/CVE-2017-9756 · Nota
• https://ubuntu.com/security/CVE-2016-4492 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9744 · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-4487 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-17360 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2020-16593 · Nota
• https://bdu.fstec.ru/vul/2019-00670 · Nota de Segurança
• https://sourceware.org/bugzilla/show_bug.cgi?id=24227 · Nota
• https://bugzilla.suse.com/1163744 · Nota
• https://bugzilla.suse.com/1183511 · Nota
• https://suse.com/security/cve/CVE-2017-12454 · Nota
• https://ubuntu.com/security/CVE-2017-14130 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-17450 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-9748 · Aviso do Fabricante