Bug 1937784 (CVE-2021-20284)

Summary:	CVE-2021-20284 binutils: Heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	adscvr, ailan, aoliva, dvlasenk, erik-fedora, fidencio, fweimer, jakub, kaycoth, klember, ktietz, manisandro, marcandre.lureau, mcermak, mnewsome, mpolacek, mprchlik, nickc, ohudlick, rjones, sipoyare, virt-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-09 22:24:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1943301, 1949308, 1961525, 1961526
Bug Blocks:	1937793, 1937804

Description Pedro Sampaio 2021-03-11 14:44:33 UTC

A flaw was found in GNU Binutils 2.35.1. There is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c because the number of symbols is not caculated correctly.

Upstream bug:

https://sourceware.org/bugzilla/show_bug.cgi?id=26931

Comment 3 Pedro Sampaio 2021-03-25 18:28:01 UTC

Created binutils tracking bugs for this issue:

Affects: fedora-all [bug 1943301]

Comment 7 Stefan Cornelius 2021-05-18 07:55:43 UTC

Patch:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f60742b2a1988d276c77d5c1011143f320d9b4cb

Comment 8 errata-xmlrpc 2021-11-09 18:28:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4364 https://access.redhat.com/errata/RHSA-2021:4364

Comment 9 Product Security DevOps Team 2021-11-09 22:23:57 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20284