Bug 1435300 – CVE-2017-7226 binutils: Heap-based buffer over-read in pe_ILF_object_p function in libbfd

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1435300 - (CVE-2017-7226) CVE-2017-7226 binutils: Heap-based buffer over-read in pe_ILF_object_p function in libbfd

Summary:	CVE-2017-7226 binutils: Heap-based buffer over-read in pe_ILF_object_p functi...

Status:	NEW

Aliases:	CVE-2017-7226

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20161201,reported=2...
Keywords:	Security

Depends On:	1435307 1435308 1435309
Blocks:
	Show dependency tree / graph

Reported:	2017-03-23 10:06 EDT by Adam Mariš
Modified:	2017-03-23 10:14 EDT (History)
CC List:	10 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Adam Mariš 2017-03-23 10:06:27 EDT

The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to information disclosure as well.

Upstream bug:

https://sourceware.org/bugzilla/show_bug.cgi?id=20905

Upstream patch:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=fa6631b4eecfcca00c13b9594e6336dffd40982f

Comment 1 Adam Mariš 2017-03-23 10:14:42 EDT

Created binutils tracking bugs for this issue:

Affects: fedora-all [bug 1435308]


Created mingw-binutils tracking bugs for this issue:

Affects: epel-all [bug 1435309]
Affects: fedora-all [bug 1435307]

Note You need to log in before you can comment on or make changes to this bug.