PT-2017-4299 · Gnu · Gnu Binutils

Published 2017-09-27 · Updated 2019-10-03 · CVE-2017-14934

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29

Description: The issue is related to the process debug info function in the dwarf.c component of GNU Binutils, which is caused by an incorrect buffer size calculation. This allows a remote attacker to cause a denial of service, specifically an infinite loop, by using a specially crafted ELF file that contains a negative size value in a CU structure.

Recommendations: For GNU Binutils version 2.29, consider disabling the process debug info function in the dwarf.c component as a temporary workaround until a patch is available. Restrict access to the dwarf.c component to minimize the risk of exploitation. Avoid using the process debug info function with untrusted ELF files until the issue is resolved.

Fix

Infinite Loop

Weakness Enumeration

CWE-131

CWE-835

Related Identifiers

BDU:2023-07754

CVE-2017-14934

Affected Products

Gnu Binutils

References · 13

• https://cve.org/CVERecord?id=CVE-2017-14934 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14934 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07754 · Security Note
• https://ubuntu.com/security/CVE-2017-14934 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-14934 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-14934 · Vendor Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=22219 · Patch
• https://osv.dev/vulnerability/CVE-2017-14934 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14934 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=19485196044b2521af979f1e5c4a89bfb90fba0b · Note
• http://securityfocus.com/bid/101204 · Note
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=19485196044b2521af979f1e5c4a89bfb90fba0b · Note