PT-2017-4306 · Gnu · Gnu Binutils

Published 2017-09-25 · Updated 2019-05-12 · CVE-2017-15023

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29

Description: The issue is related to the read formatted entries function in the dwarf2.c component of the Binary File Descriptor (BFD) library, which does not properly validate the format count. This allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash, via a crafted ELF file. The vulnerability is related to the concat filename function.

Recommendations: For GNU Binutils version 2.29, consider updating to a newer version that addresses this issue. As a temporary workaround, restrict the use of crafted ELF files to minimize the risk of exploitation. Avoid using the read formatted entries function in the dwarf2.c component until a patch is available.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2023-07761

CVE-2017-15023

MGASA-2019-0169

Affected Products

Gnu Binutils

References · 44

• https://nvd.nist.gov/vuln/detail/CVE-2017-15023 · Security Note
• https://sourceware.org/bugzilla/show_bug.cgi?id=22200 · Patch
• https://blogs.gentoo.org/ago/2017/10/03/binutils-null-pointer-dereference-in-concat_filename-dwarf2-c · Patch
• https://security.gentoo.org/glsa/201801-01 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15023 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15023 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15023 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15023 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/37N6SA4WSBTFWAMPQXHSO7JRJQ6EIIO5 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0169 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15023 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-15023 · Security Note
• https://advisories.mageia.org/MGASA-2019-0169.html · Security Note
• https://bdu.fstec.ru/vul/2023-07761 · Security Note