Bug 1680672 (CVE-2019-9076) - CVE-2019-9076 binutils: excessive memory allocation in function elf_read_notes in elf.c
Summary: CVE-2019-9076 binutils: excessive memory allocation in function elf_read_note...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-9076
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1680673
Blocks: 1680680
TreeView+ depends on / blocked
 
Reported: 2019-02-25 13:52 UTC by Dhananjay Arunesh
Modified: 2019-09-29 15:08 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-03-20 19:29:28 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2019-02-25 13:52:00 UTC 
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an attempted excessive memory allocation in elf_read_notes in elf.c.

Reference:
https://sourceware.org/bugzilla/show_bug.cgi?id=24238
Comment 1 Dhananjay Arunesh 2019-02-25 13:52:15 UTC 
Created binutils tracking bugs for this issue:

Affects: fedora-all [bug 1680673]
Comment 2 Nick Clifton 2019-02-26 12:09:25 UTC 
Note - this is not a real CVE.  A corrupt input file is causing one of the binutils 
tools to attempt to allocate more memory than is available on the host machine.  
Under normal circumstances this allocation will fail, the tool will detect the 
failure and correctly report an "out of memory" error.  The CVE was filed against a 
version of the tool which had been compiled with address sanitization enabled, which
meant that the over-large memory allocation was caught and flagged as an error
before the tool could handle it.
Comment 3 Scott Gayou 2019-03-20 19:28:38 UTC 
Looks to be the same style of "issue" as https://bugzilla.redhat.com/show_bug.cgi?id=1680660

I.e., looks correct, seems like an invalid CVE. NOTABUG!
Note You need to log in before you can comment on or make changes to this bug.