PT-2020-6702 · Gnu+4 · Gnu Binutils+4

Published 2020-12-09 · Updated 2024-06-15 · CVE-2020-16592

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.34

Description A use after free issue exists in the Binary File Descriptor (BFD) library, specifically in the bfd hash lookup function, which can cause a denial of service via a crafted file. This issue is demonstrated in nm-new.

Recommendations For GNU Binutils version 2.34, consider updating to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting the use of the bfd hash lookup function until a patch is available.

Exploit

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2022-05642

CVE-2020-16592

MGASA-2021-0011

OESA-2021-1098

OPENSUSE-SU-2021:1475-1

OPENSUSE-SU-2021:3616-1

OPENSUSE-SU-2021_1475-1

OPENSUSE-SU-2021_3616-1

OPENSUSE-SU-2024:10651-1

SUSE-SU-2021:3593-1

SUSE-SU-2021:3616-1

SUSE-SU-2022:0934-1

USN-5124-1

Affected Products

Astra Linux

Gnu Binutils

Linuxmint

Suse

Ubuntu

References · 189

• 🔥 https://github.com/tin-z/CVE-2021-20294-POC · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=25823 · Exploit
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/DJIW6KKY2TSLD43XEZXG56WREIIBUIIQ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJIW6KKY2TSLD43XEZXG56WREIIBUIIQ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16592 · Security Note
• https://ubuntu.com/security/CVE-2020-16592 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1098 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05642 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:3616-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-16592 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10651-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-16592 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0934-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5124-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0551 · Security Note