PT-2019-6396 · Gnu+6 · Gnu Binutils+6

Zjuchenyuan · Published 2019-10-08 · Updated 2024-06-15 · CVE-2019-17450

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.32

Description The issue is related to the find abstract instance function in the dwarf2.c component of the BFD library, which is part of GNU Binutils. It allows remote attackers to cause a denial of service by triggering infinite recursion and application crash via a crafted ELF file. This is due to uncontrolled recursion in the find abstract instance function.

Recommendations For GNU Binutils version 2.32, consider avoiding the use of the find abstract instance function in the dwarf2.c component until a patch is available. As a temporary workaround, restrict the processing of crafted ELF files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

ALT-PU-2020-3352

ALT-PU-2020-3433

ALT-PU-2021-1230

BDU:2023-07808

CESA-2020_4465

CVE-2019-17450

MGASA-2020-0112

OPENSUSE-SU-2020:1790-1

OPENSUSE-SU-2020:1804-1

OPENSUSE-SU-2020_1790-1

OPENSUSE-SU-2020_1804-1

OPENSUSE-SU-2024:10651-1

RHSA-2020:4465

RHSA-2020_4465

SUSE-SU-2020:3060-1

SUSE-SU-2020:3552-1

SUSE-SU-2021:3593-1

USN-4336-1

USN-4336-2

Affected Products

Alt Linux

Astra Linux

Centos

Gnu Binutils

Red Hat

Suse

Ubuntu

References · 661

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=25078 · Exploit
• https://ubuntu.com/security/CVE-2016-4492 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9744 · Security Note
• https://ubuntu.com/security/CVE-2016-4487 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17360 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00670 · Security Note
• https://ubuntu.com/security/CVE-2017-14130 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17450 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9748 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17985 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7209 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9751 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19931 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17121 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10372 · Security Note