Bug 2167467 (CVE-2023-25584)

Summary:	CVE-2023-25584 binutils: Out of bounds read in parse_module function in bfd/vms-alpha.c
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ailan, bdettelb, caswilli, dffrench, dfreiber, dkuc, doconnor, drow, fjansen, fweimer, gdb-bugs, gzaronik, hkataria, jburrell, jforrest, jkoehler, jmitchel, jsamir, jtanner, jwon, kaycoth, keiths, kholdawa, kshier, lcouzens, lphiri, mcermak, micjohns, mpolacek, mprchlik, mskarbek, ngough, nickc, ohudlick, rgodfrey, rjones, sipoyare, sthirugn, teagle, virt-maint, vkrizan, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:	An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2174117, 2174118, 2174119, 2174120, 2174121, 2174122, 2174123, 2174124, 2174125, 2174180, 2174181
Bug Blocks:	2160830

Description Pedro Sampaio 2023-02-06 17:27:53 UTC

Out of bounds read flaws were found in Binutils in parse_module function in bfd/vms-alpha.c

Upstream fix:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=77c225bdeb410cf60da804879ad41622f5f1aa44

Comment 1 Siddhesh Poyarekar 2023-02-06 18:41:04 UTC

I don't think we build this in RHEL/Fedora binutils configurations.  Nick, can you confirm?

Comment 3 Nick Clifton 2023-02-07 12:20:31 UTC

(In reply to Siddhesh Poyarekar from comment #1)
> I don't think we build this in RHEL/Fedora binutils configurations.  Nick,
> can you confirm?

Almost.  We do not build it for Fedora (rawhide/f37/f36) or RHEL-9.
But we do build it for RHEL-8, RHEL-7 and RHEL-6.  This is because,
for those targets, there is a problem with the configure script for
the gold linker when the s390x architecture is targeted.  In order 
to work around this problem I configure the s390x binutils with the
--enable-targets=all option, which then includes support for vms-alpha.

There is a solution for this workaround which removes the need to
build for all targets, and it could be backported to RHEL 8/7/6,
but at the time I felt that since the workaround solves the problem,
creating an update was just creating extra work.

Comment 9 Siddhesh Poyarekar 2023-03-01 17:35:00 UTC

This does not affect gdb in RHEL or Fedora; gdb does not have or build the affected code.