Bug 2344896 - CVE-2025-0840 binutils: GNU Binutils objdump.c disassemble_bytes stack-based overflow [fedora-41]
Summary: CVE-2025-0840 binutils: GNU Binutils objdump.c disassemble_bytes stack-based ...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: binutils
Version: 41
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Nick Clifton
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["c0fb1238-9288-48e6-8188-e...
Depends On:
Blocks: CVE-2025-0840
TreeView+ depends on / blocked
 
Reported: 2025-02-11 13:42 UTC by Michal Findra
Modified: 2025-03-20 13:27 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-03-18 10:43:06 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Michal Findra 2025-02-11 13:42:22 UTC
More information about this security flaw is available in the following bug:

https://bugzilla.redhat.com/show_bug.cgi?id=2342875

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 2 Nick Clifton 2025-03-17 16:04:19 UTC
I would like to contest reopening this bug.

First of all the SECURITY.txt document that ships as part of the binutils sources makes it clear that bugs in inspection tools like objdump are not considered to be security issues as they cannot affect the generation of good binaries.

Second of all the CVE suggests that this flaw can be triggered remotely, but it is hard to see how this is possible.  The objdump program has no network connectivity, and I fail to see how a remote attack could make use of it.

Finally all that the flaw can do is to cause the objdump program to fail with an illegal memory access.  Since the program is not intended to remain in-memory or provide any kind of service, having it terminate will not affect any other process or user.

Comment 3 Nick Clifton 2025-03-18 10:43:06 UTC
I am going to close this BZ.

I feel that the bug does not really meet the criteria for a CVE.  Or at least a CVE that needs to be fixed here.  

The current rawhide binutils include that patch that fixes the bug, and I do not feel that it is worth backporting the patch to other Fedora releases since the problem can only be triggered by corrupt input, not valid files.


Note You need to log in before you can comment on or make changes to this bug.