GNU Binutils vulnerabilities

GNU Binutils through 2.45.1 contains a denial-of-service vulnerability in readelf when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning without forward progress, resulting in a non-terminating output loop requiring manual interruption. No evidence of memory corruption or code execution was observed.

GNU Binutils readelf through 2.45.1 contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw causes readelf to repeatedly print the same table output without progress, resulting in an unbounded output loop.

GNU Binutils through 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines, and an unexpected data length of zero triggers a fatal abort in byte_get_little_endian().

GNU Binutils through 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. The internal all_relocations array may remain partially uninitialized, and later process_got_section_contents() may attempt to free an invalid r_symbol pointer, triggering memory corruption checks in glibc and causing the program to terminate with SIGABRT. The impact is limited to denial of service; the issue is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in handling the debug_rnglists header causes objdump to repeatedly print the same warning and fail to terminate.

An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This allows a local attacker to cause excessive resource consumption by supplying a malicious input file.

In GNU Binutils 2.43, the xstrdup function in xstrdup.c of the ld component causes a memory leak. The attack can be launched remotely but has high complexity and is difficult to exploit. The exploit has been publicly disclosed and may be used.

The load_debug_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via an ELF file that lacks section headers.

GNU Binutils 2.29.1 has a mishandling issue with certain global symbols in nm.c and objdump.c, which can lead to application crashes or denial of service.

The _bfd_coff_read_string_table function in the BFD library (libbfd) in GNU Binutils 2.29.1 does not properly validate the size of the external string table, which can lead to denial of service or buffer overflow.

The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which can lead to denial of service or heap-based buffer overflow.

The Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (memory access violation) or possibly have unspecified other impact via a COFF binary in which a relocation refers to a location after the end of the to-be-relocated section.

The pe_bfd_read_buildid function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 does not validate size and offset values in the data dictionary, allowing remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file.

The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 lacks integer-overflow protection on 32-bit platforms, allowing remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file.

The _bfd_elf_parse_gnu_properties function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 does not prevent negative pointers, which may lead to application crashes or other unspecified impacts via a crafted ELF file.

The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service through integer overflow and heap-based buffer over-read, potentially leading to application crashes.

The aout_get_external_symbols function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service via a crafted ELF file, potentially leading to application crashes.

In elfcomm.c in readelf in GNU Binutils 2.29, a vulnerability allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file. The issue is related to a buffer overflow on a fuzzed archive header, concerning an uninitialized variable and an improper conditional jump.

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 interpret a -1 value as a sorting count instead of an error flag. This can lead to denial of service (integer overflow and application crash) when processing a crafted ELF file.

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 do not ensure a unique PLT entry for a symbol. This allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file.

The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next during 'readelf -a' execution.

In libiberty (as distributed with GNU Binutils 2.29), the C++ symbol demangler routine in cplus-dem.c allows a remote attacker to cause a denial of service (excessive memory allocation and application crash) via a crafted file. This is demonstrated through a call from the BFD library (libbfd).

The setup_group function in elf.c in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small.

The elf_read_notes function in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

The bfd_mach_o_read_symtab_strtab function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap write, potentially leading to code execution via a crafted mach-o file.

The bfd_make_section_with_flags function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause a NULL dereference via a crafted file.

The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils version 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.

The _bfd_vms_slurp_egsd function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.

The _bfd_vms_slurp_eeom function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.

The bfd_mach_o_i386_canonicalize_one_reloc function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.

The _bfd_xcoff_read_ar_hdr function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.

The _bfd_vms_save_sized_string function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted vms file.

The bfd_cache_close function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 and earlier allows remote attackers to cause a heap use after free, potentially leading to code execution via a crafted nested archive file. This issue arises from incorrect function calls during an attempt to release memory.

The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted binary file.

The opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode, allowing remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

The process_otr function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 does not validate a certain offset, allowing remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

The versados_mkobject function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 does not initialize a certain data structure, allowing remote attackers to cause a denial of service (buffer overflow and application crash) or potentially other unspecified impacts via a crafted binary file.

The Binary File Descriptor (BFD) library in GNU Binutils 2.28 contains a vulnerability that allows remote attackers to cause application crashes via buffer overflow when processing a specially crafted binary file.

In GNU Binutils 2.28, the unbounded GETBYTE macro in opcodes/rl78-decode.opc allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

In GNU Binutils 2.28, the opcodes/rx-decode.opc file lacks bounds checks for certain scale arrays, allowing remote attackers to cause a denial of service (buffer overflow and application crash) or potentially unspecified other impact via a crafted binary file.

The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

The ieee_object_p function in the Binary File Descriptor (BFD) library in GNU Binutils version 2.28 may allow remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted binary file, as demonstrated during 'objdump -D' execution.

The ieee_archive_p function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 may allow remote attackers to cause application crashes via buffer overflow, leading to denial of service. This issue may be related to a compiler bug.

The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted binary file.

The _bfd_vms_slurp_etir function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 allows remote attackers to cause a denial of service via a buffer overflow, leading to application crash. This issue occurs when handling a crafted binary file during 'objdump -D' execution.

The sh_elf_set_mach_from_flags function in the Binary File Descriptor (BFD) library in GNU Binutils 2.28 allows remote attackers to cause a denial of service via a buffer overflow, leading to application crash. This issue occurs when handling a crafted binary file during 'objdump -D' execution.

The print_insn_score32 function in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted binary file, as demonstrated by mishandling of this file during 'objdump -D' execution.

The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted binary file.

The readelf.c in GNU Binutils as of 2017-04-12 has a 'shift exponent too large for type unsigned long' issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.

The readelf.c in GNU Binutils as of 2017-04-12 has a 'cannot be represented in type long' issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.