PT-2021-13876 · Gnu+7 · Gnu Binutils+7

Hao Wang · Published 2020-11-22 · Updated 2024-06-15 · CVE-2021-20284

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.35.1

Description: A flaw was found in GNU Binutils, where there is a heap-based buffer overflow in bfd elf slurp secondary reloc section in elf.c due to the number of symbols not calculated correctly. The highest threat from this issue is to system availability.

Recommendations: For GNU Binutils version 2.35.1, consider updating to a newer version to mitigate the risk, as the current version has a heap-based buffer overflow issue. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

ALSA-2021:4364

ALT-PU-2021-2153

CESA-2021_4364

CVE-2021-20284

OPENSUSE-SU-2021:1475-1

OPENSUSE-SU-2021:3616-1

OPENSUSE-SU-2021_1475-1

OPENSUSE-SU-2021_3616-1

OPENSUSE-SU-2024:10651-1

RHSA-2021:4364

RHSA-2021_4364

RLSA-2021:4364

SUSE-SU-2021:3593-1

SUSE-SU-2021:3616-1

SUSE-SU-2022:0934-1

Affected Products

Alt Linux

Almalinux

Centos

Debian

Gnu Binutils

Red Hat

Rocky Linux

Suse

References · 183

• 🔥 https://github.com/tin-z/CVE-2021-20294-POC · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1937784 · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=26931 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2021:3616-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-20284 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10651-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-30 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-20284 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:3616-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3593-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1475-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0934-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:4364 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-4364.html · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4364 · Vendor Advisory