PT-2017-4307 · Gnu+1 · Gnu Binutils+1

Published 2017-09-22 · Updated 2021-07-21 · CVE-2017-15024

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29

Description: The issue is related to the find abstract instance name function in the dwarf2.c component of the GNU Binutils. It allows a remote attacker to cause a denial of service by executing an infinite recursion, leading to an application crash. This can be achieved through a specially crafted ELF file.

Recommendations: For GNU Binutils version 2.29, consider updating to a newer version that contains a fix for this issue. As a temporary workaround, restrict the use of the find abstract instance name function in the dwarf2.c component to minimize the risk of exploitation. Avoid processing untrusted ELF files until the issue is resolved.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2023-07762

CVE-2017-15024

MGASA-2019-0169

USN-4336-2

Affected Products

Gnu Binutils

Ubuntu

References · 486

• https://ubuntu.com/security/CVE-2016-4492 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9744 · Security Note
• https://ubuntu.com/security/CVE-2016-4487 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17360 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00670 · Security Note
• https://ubuntu.com/security/CVE-2017-14130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17794 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9748 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14940 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17985 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7209 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9751 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19931 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17121 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7209 · Security Note