Bug 2165837 (CVE-2023-22603)

Summary: CVE-2023-22603 binutils: objdump SEGV in display_debug_lines_decoded
Product: [Other] Security Response Reporter: Dhananjay Arunesh <darunesh>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acrosby, ailan, bdettelb, caswilli, dffrench, dkuc, fjansen, fweimer, gdb-bugs, gzaronik, hbraun, hkataria, jburrell, jkoehler, jmitchel, jtanner, jwon, kaycoth, keiths, kshier, mcermak, micjohns, mnewsome, mpolacek, mprchlik, ngough, nickc, ohudlick, rgodfrey, rjones, sipoyare, sthirugn, virt-maint
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: binutils 2.40 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-02-06 07:07:18 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2157097    

Description Dhananjay Arunesh 2023-01-31 09:04:30 UTC
A vulnerability was found in binutils where, objdump SEGV found in display_debug_lines_decoded in dwarf.c.

References:
https://sourceware.org/bugzilla/show_bug.cgi?id=29870
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f2f58a399cf3f946983398cdfe52d0eaa72bf877

Comment 1 Siddhesh Poyarekar 2023-01-31 11:20:12 UTC
objdump is a standalone binary.  This is not a security issue, it's just a regular crash so please reject the CVE.

Comment 3 Dhananjay Arunesh 2023-02-06 07:08:43 UTC
In reply to comment #1:
> objdump is a standalone binary.  This is not a security issue, it's just a
> regular crash so please reject the CVE.

CVE rejected.