GNU Binutils up to 2.39 readelf readelf.c find_section_in_set heap-based overflow

Summaryinfo

A vulnerability, which was classified as critical, was found in GNU Binutils up to 2.39. The affected element is the function find_section_in_set of the file readelf.c of the component readelf. Such manipulation leads to heap-based overflow. This vulnerability is listed as CVE-2022-44840. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in GNU Binutils up to 2.39 (Programming Tool Software) and classified as critical. Affected by this issue is the function find_section_in_set of the file readelf.c of the component readelf. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.

The weakness was presented 08/23/2023. The advisory is shared for download at sourceware.org. This vulnerability is handled as CVE-2022-44840 since 11/07/2022. There are known technical details, but no exploit is available.

Upgrading to version 2.40 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Tool Software

Vendor

• GNU

Name

• Binutils

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion