GNU binutils 2.29.1 coffgen.c bfd_coff_read_string_table memory corruption

Summaryinfo

A vulnerability described as critical has been identified in GNU binutils 2.29.1. This affects the function bfd_coff_read_string_table of the file coffgen.c. The manipulation results in memory corruption. This vulnerability was named CVE-2017-17124. The attack needs to be approached locally. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in GNU binutils 2.29.1 (Programming Tool Software). Affected is the function bfd_coff_read_string_table of the file coffgen.c. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The _bfd_coff_read_string_table function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not properly validate the size of the external string table, which allows remote attackers to cause a denial of service (excessive memory consumption, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted COFF binary.

The bug was discovered 11/28/2017. The weakness was presented 12/04/2017 (Website). The advisory is available at sourceware.org. This vulnerability is traded as CVE-2017-17124 since 12/04/2017. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 6 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 119162 (GLSA-201811-17 : Binutils: Multiple vulnerabilities), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Gentoo Local Security Checks and running in the context l.

Upgrading eliminates this vulnerability. A possible mitigation has been published 2 years after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (119162). See VDB-107299, VDB-110111, VDB-110175 and VDB-110176 for similar entries. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Tool Software

Vendor

• GNU

Name

• binutils

Version

• 2.29.1

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion