PT-2022-6748 · Gnu+6 · Gnu Binutils+6

Shuang Po · Published 2022-08-13 · Updated 2026-01-30 · CVE-2022-38533

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils versions prior to 2.4.0

Description The issue is related to a heap-buffer-overflow in the error function bfd getl32 when called from the strip main function in strip-new via a crafted file. This can lead to a denial of service. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For GNU Binutils versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted files that could trigger the heap-buffer-overflow in the bfd getl32 function. Restrict access to the strip-new function to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2023-1379

ALT-PU-2023-4098

ALT-PU-2024-9331

AZL-10714

BDU:2023-03853

CLEANSTART-2026-HF39630

CVE-2022-38533

MGASA-2022-0425

OPENSUSE-SU-2022_4146-1

OPENSUSE-SU-2024:12631-1

SUSE-SU-2022:4146-1

SUSE-SU-2022:4277-1

USN-5762-1

USN-6544-1

Affected Products

Alt Linux

Astra Linux

Debian

Gnu Binutils

Linuxmint

Suse

Ubuntu

References · 90

• https://osv.dev/vulnerability/USN-5762-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-4285 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5762-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19931 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0425 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-38533 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2022-38533 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12631-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0425.html · Security Note
• https://osv.dev/vulnerability/AZL-10714 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-19726 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20241017SE16 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MTEHT3G6YKJ7F7MSGWYSI4UM3XBAYXZ · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-35205 · Vendor Advisory