Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. There's a flaw in binutils 2.46.1 in rsrc_print_name() and rsrc_parse_entries() functions by which an attacker with local access or whom does not have local access but social engineers a victim to run binutils on a crafted PE file, can execute malicious code.
This is not an issue for several reasons. Most simply, Fedora (linux distros generally) do not use PE/COFF formats. Only ELF/DWARF is used. Therefore, it would be an especially naive developer who would attempt to load such a compromised file into a distro's gdb. Moreover, the affected function, rsrc_print_name, is only used from rsrc_resource_name, which is only used from rsrc_sort_entries while reporting a duplicate .rsrc section. All of this results only from a call to bfd_final_link: ld (ldwrite.c) -> bfd_final_link -> _bfd_coff_final_link -> bfd_coff_final_link_postscript -> rsrc_process_section -> rsrc_parse_entries / rsrc_parse_entry <- unchecked 16-bit length (LEN) -> rsrc_sort_entries -> rsrc_resource_name <- fixed 256-byte buffer -> rsrc_print_name <- where LEN bytes are written to the fixed-length buffer GDB never calls bfd_final_link. It is not a linker. The compile machinery does not use this route, either, and that feature is no longer supported on Fedora.