Bug 1664712 (CVE-2018-20671) - CVE-2018-20671 binutils: Integer overflow in load_specific_debug_section function
Summary: CVE-2018-20671 binutils: Integer overflow in load_specific_debug_section func...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-20671
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1664713 1664714 1664715 Red Hat1666219 Engineering1666220
Blocks: Embargoed1664716
TreeView+ depends on / blocked
 
Reported: 2019-01-09 13:46 UTC by Andrej Nemec
Modified: 2021-10-27 03:21 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-27 03:21:32 UTC

Attachments (Terms of Use)

Description Andrej Nemec 2019-01-09 13:46:27 UTC 
An integer overflow was found in load_specific_debug_section function.

Upstream issue:

https://sourceware.org/bugzilla/show_bug.cgi?id=24005

Upstream patch:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=11fa9f134fd658075c6f74499c780df045d9e9ca
Comment 1 Andrej Nemec 2019-01-09 13:48:21 UTC 
Created binutils tracking bugs for this issue:

Affects: fedora-all [bug 1664713]


Created mingw-binutils tracking bugs for this issue:

Affects: epel-all [bug 1664715]
Affects: fedora-all [bug 1664714]
Comment 2 Riccardo Schirone 2019-01-15 08:58:31 UTC 
When binutils is compiled in 32bit mode, an integer overflow is possible in load_specific_debug_section function() in objdump.c which may lead to an heap-based buffer overflow in bfd_get_full_section_contents().
Comment 6 Riccardo Schirone 2019-01-23 08:54:19 UTC 
Statement:

This issue did not affect the versions of binutils as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include the vulnerable code. Moreover the flaw can only be triggered on 32bit versions of the component.
Note You need to log in before you can comment on or make changes to this bug.