GNU Binutils vulnerabilities

A critical vulnerability was found in GNU Binutils up to 2.44 in the elf_gc_sweep function of bfd/elflink.c in the ld component. Manipulation leads to memory corruption. The attack must be approached locally, and the exploit has been disclosed to the public and may be used.

A vulnerability has been found in GNU Binutils 2.43/2.44 in the function display_info of the file binutils/bucomm.c of the objdump component. The manipulation leads to memory leak. The attack requires local access, and the exploit has been publicly disclosed.

In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.