Bug 2167502 (CVE-2023-25586)

Summary:	CVE-2023-25586 binutils: Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ailan, bdettelb, caswilli, dffrench, dkuc, fjansen, fweimer, gdb-bugs, gzaronik, hkataria, jburrell, jkoehler, jmitchel, jtanner, jwon, kaycoth, keiths, kshier, mcermak, micjohns, mpolacek, mprchlik, ngough, nickc, ohudlick, rgodfrey, rjones, sipoyare, sthirugn, virt-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:	A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2160830

Description Pedro Sampaio 2023-02-06 20:04:55 UTC

In Binutils, at function `bfd_init_section_decompress_status`, a local variable is supposed to be initialized by function `bfd_check_compression_header`. However, since this function call is inside an `else if` branch, if the previous `if` branch is taken, the `ch_type` can be uninitialized and thus directly used to assign `sec->compress_status`. Therefore, when the `compress_status` field is used in a branch condition, the memory sanitizer aborts.

Upstream bug:

https://sourceware.org/bugzilla/show_bug.cgi?id=29855

Upstream fix:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5830876a0cca17bef3b2d54908928e72cca53502