CVE-2017-8398
HighSummary
The dwarf.c file in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that analyze binary files, such as objdump and readelf, to crash.
Risk Assessment
Organizations may experience stability issues with binary analysis tools, potentially leading to downtime and data loss.
Recommendation
It is recommended to update GNU Binutils to the latest version to mitigate this vulnerability and to monitor binary files for corruption.
Other vulnerabilities in GNU Binutils 2.28
See all- CVE-2017-17126High
The load_debug_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via an ELF file that lacks section headers.
- CVE-2017-17125High
GNU Binutils 2.29.1 has a mishandling issue with certain global symbols in nm.c and objdump.c, which can lead to application crashes or denial of service.
- CVE-2017-17124High
The _bfd_coff_read_string_table function in the BFD library (libbfd) in GNU Binutils 2.29.1 does not properly validate the size of the external string table, which can lead to denial of service or buffer overflow.
- CVE-2017-17122High
The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which can lead to denial of service or heap-based buffer overflow.
- CVE-2017-17121High
The Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (memory access violation) or possibly have unspecified other impact via a COFF binary in which a relocation refers to a location after the end of the to-be-relocated section.
- CVE-2017-16832High
The pe_bfd_read_buildid function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 does not validate size and offset values in the data dictionary, allowing remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file.
- CVE-2017-16830High
The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 lacks integer-overflow protection on 32-bit platforms, allowing remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file.
- CVE-2017-16829High
The _bfd_elf_parse_gnu_properties function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 does not prevent negative pointers, which may lead to application crashes or other unspecified impacts via a crafted ELF file.
- CVE-2017-16828High
The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service through integer overflow and heap-based buffer over-read, potentially leading to application crashes.
- CVE-2017-16827High
The aout_get_external_symbols function in the Binary File Descriptor (BFD) library in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service via a crafted ELF file, potentially leading to application crashes.
Original NVD description (English source)
dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that conduct an analysis of binary programs, such as objdump and readelf, to crash.