PT-2017-4300 · Gnu+1 · Gnu Binutils+1

Agostino Sarubbo · Published 2017-09-21 · Updated 2021-07-21 · CVE-2017-14938

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: GNU Binutils versions 2.29 and earlier

Description: The issue allows remote attackers to cause a denial of service, resulting in excessive memory allocation and an application crash, via a crafted ELF file. This is due to the bfd elf slurp version tables function in the elf.c component of the Binary File Descriptor (BFD) library, which permits unlimited memory allocation.

Recommendations: For GNU Binutils versions 2.29 and earlier, consider updating to a version later than 2.29 to resolve the issue. As a temporary workaround, consider restricting the use of the bfd elf slurp version tables function in the elf.c component until a patch is available. Avoid processing crafted ELF files with the affected GNU Binutils versions to minimize the risk of exploitation.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2023-07755

CVE-2017-14938

MGASA-2019-0169

USN-4336-2

Affected Products

Gnu Binutils

Ubuntu

References · 487

• https://ubuntu.com/security/CVE-2016-4492 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9744 · Security Note
• https://ubuntu.com/security/CVE-2016-4487 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17360 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00670 · Security Note
• https://blogs.gentoo.org/ago/2017/09/26/binutils-memory-allocation-failure-in-_bfd_elf_slurp_version_tables-elf-c · Patch
• https://ubuntu.com/security/CVE-2017-14130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17794 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9748 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14938 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14940 · Vendor Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=22166 · Patch
• https://ubuntu.com/security/CVE-2018-17985 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7209 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9751 · Security Note