There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

An update of the binutils package has been released.

An update of the crash package has been released.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the gcc-toolset-13-binutils-2.40-8.el9 build changelog.

  - GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation,     Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is:
    gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff     header field must be opened. (CVE-2019-1010204)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in GNU     Binutils version 2.36. A crafted symbol can cause stack memory to be exhausted leading to a crash.
    (CVE-2021-3530)

  - An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt     symbol version information may result in a denial of service. This issue is the result of an incomplete     fix for CVE-2020-16599. (CVE-2022-4285)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4364 advisory.

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has binutils packages installed that are affected by multiple vulnerabilities:

  - process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf.
    (CVE-2018-10372)

  - concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in     GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and     application crash) via a crafted binary file, as demonstrated by nm-new. (CVE-2018-10373)

  - The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD)     library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with     an unbounded loop that increases the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address     exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy     copying private info with _bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c. (CVE-2018-10534)

  - The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab     entry with a SECTION type that has a 0 value, which allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.
    (CVE-2018-10535)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.31. An invalid memory access exists in _bfd_stab_section_find_nearest_line in syms.c. Attackers     could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file.
    (CVE-2018-17358)

  - The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka     libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a     denial of service (memory consumption), as demonstrated by nm. (CVE-2018-20002)

  - The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication     is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash)     or possibly have unspecified other impact. (CVE-2018-6323)

  - The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka     libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could     leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file.
    (CVE-2018-6759)

  - In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a     denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as     demonstrated by objcopy of a COFF object. (CVE-2018-7208)

  - The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow     and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm.
    (CVE-2018-7568)

  - dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30,     allows remote attackers to cause a denial of service (integer underflow or overflow, and application     crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm. (CVE-2018-7569)

  - The assign_file_positions_for_non_load_sections function in elf.c in the Binary File Descriptor (BFD)     library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a     matching LOAD segment, as demonstrated by objcopy. (CVE-2018-7570)

  - The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service     (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as     demonstrated by objcopy. (CVE-2018-7642)

  - The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a     denial of service (integer overflow and application crash) or possibly have unspecified other impact via a     crafted ELF file, as demonstrated by objdump. (CVE-2018-7643)

  - The bfd_section_from_shdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation     fault) via a large attribute section. (CVE-2018-8945)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

  - ** DISPUTED ** An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through     14.0. It permits the visual reordering of characters via control sequences, which can be used to craft     source code that renders different logic than the logical ordering of tokens ingested by compilers and     interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such     that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium     offers the following alternative approach to presenting this concern. An issue is noted in the nature of     international text that can affect applications that implement support for The Unicode Standard and the     Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-     right and right-to-left characters, the visual order of tokens may be different from their logical order.
    Additionally, control characters needed to fully support the requirements of bidirectional text can     further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such     that the ordering of tokens perceived by human reviewers does not match what will be processed by a     compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its     document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also     provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode     Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the     BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading     visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.
    (CVE-2021-42574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-30 (GNU Binutils: Multiple Vulnerabilities)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using     readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary     data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and     availability. (CVE-2021-20294)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

  - A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in GNU     Binutils version 2.36. A crafted symbol can cause stack memory to be exhausted leading to a crash.
    (CVE-2021-3530)

  - An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this     flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in     some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system     availability. (CVE-2021-3549)

  - stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of     service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-     of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699. (CVE-2021-45078)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0934-1 advisory.

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using     readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary     data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and     availability. (CVE-2021-20294)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4364 advisory.

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4364 advisory.

    [2.30-108.0.2]
    - Forward-port the following update:
      [2.30-93.0.4
      - Backport fix for fencepost bug in CTF pptrtab usage causing coredumps
      - Backport test result fixes for new GCC-based CTF generation         [Orabug: 33344570]
      - Reviewed-by: David Faust <david.faust@oracle.com>
    - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    [2.30-108.0.1]
    - Forward-port Oracle patches from 2.30-93.0.3 to 2.30-108.0.1
    - Reviewed-by: Elena Zannoni <elena.zannoni@oracle.com>

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1475-1 advisory.

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by     its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2020-16598)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using     readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary     data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and     availability. (CVE-2021-20294)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4364 advisory.

  - binutils: Heap-based buffer overflow in bfd_getl_signed_32() in libbfd.c because sh_entsize is not     validated in _bfd_elf_slurp_secondary_reloc_section() in elf.c (CVE-2020-35448)

  - binutils: Race window allows users to own arbitrary files (CVE-2021-20197)

  - binutils: Heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c (CVE-2021-20284)

  - binutils: Excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c     read_section() (CVE-2021-3487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4364 advisory.

    The binutils packages provide a collection of binary utilities for the manipulation of object code in     various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf,     size, strings, strip, and addr2line utilities.

    Security Fix(es):

    * binutils: Excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c     read_section() (CVE-2021-3487)

    * binutils: Race window allows users to own arbitrary files (CVE-2021-20197)

    * binutils: Heap-based buffer overflow in bfd_getl_signed_32() in libbfd.c because sh_entsize is not     validated in _bfd_elf_slurp_secondary_reloc_section() in elf.c (CVE-2020-35448)

    * binutils: Heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c (CVE-2021-20284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3616-1 advisory.

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3616-1 advisory.

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by     its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2020-16598)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3593-1 advisory.

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in     elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.
    (CVE-2019-12972)

  - An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in     simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant     heap-based buffer overflow. (CVE-2019-14250)

  - apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to     trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as     demonstrated by readelf. (CVE-2019-14444)

  - find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion     and application crash) via a crafted ELF file. (CVE-2019-17450)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c,     as demonstrated by nm. (CVE-2019-17451)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from     pex64_get_runtime_function in pei-x86_64.c. (CVE-2019-9074)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c.
    (CVE-2019-9075)

  - An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific     in readelf.c via a malformed MIPS option section. (CVE-2019-9077)

  - A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35     in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

  - A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to     an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

  - A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils     2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
    (CVE-2020-16592)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can     cause a denial of service via a crafted file. (CVE-2020-16593)

  - A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new,     that can cause a denial of service via a crafted file. (CVE-2020-16599)

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed     by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to     application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in the BFD library of binutils in     versions before 2.36. An attacker who supplies a     crafted file to an application linked with BFD, and     using the DWARF functionality, could cause an impact to     system availability by way of excessive memory     consumption.(CVE-2021-3487)

  - There is an open race window when writing output in the     following utilities in GNU binutils version 2.35 and     earlier:ar, objcopy, strip, ranlib. When these     utilities are run as a privileged user (presumably as     part of a script updating binaries across different     users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a     symlink.(CVE-2021-20197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - There is an open race window when writing output in the     following utilities in GNU binutils version 2.35 and     earlier:ar, objcopy, strip, ranlib. When these     utilities are run as a privileged user (presumably as     part of a script updating binaries across different     users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a     symlink.(CVE-2021-20197)

  - Not found.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in the BFD library of binutils in     versions before 2.36. An attacker who supplies a     crafted file to an application linked with BFD, and     using the DWARF functionality, could cause an impact to     system availability by way of excessive memory     consumption.(CVE-2021-3487)

  - There is an open race window when writing output in the     following utilities in GNU binutils version 2.35 and     earlier:ar, objcopy, strip, ranlib. When these     utilities are run as a privileged user (presumably as     part of a script updating binaries across different     users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a     symlink.(CVE-2021-20197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There is an open race window when writing output in the     following utilities in GNU binutils version 2.35 and     earlier:ar, objcopy, strip, ranlib. When these     utilities are run as a privileged user (presumably as     part of a script updating binaries across different     users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a     symlink.(CVE-2021-20197)

  - There's a flaw in the BFD library of binutils in     versions before 2.36. An attacker who supplies a     crafted file to an application linked with BFD, and     using the DWARF functionality, could cause an impact to     system availability by way of excessive memory     consumption.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-354441fcdd advisory.

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204300	Photon OS 4.0: Binutils PHSA-2023-4.0-0426	Nessus	PhotonOS Local Security Checks	high
203822	Photon OS 3.0: Crash PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	critical
203529	Photon OS 4.0: Crash PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	critical
195456	RHEL 6 : binutils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195378	RHEL 7 : binutils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
191276	CentOS 9 : gcc-toolset-13-binutils-2.40-8.el9	Nessus	CentOS Local Security Checks	medium
184618	Rocky Linux 8 : binutils (RLSA-2021:4364)	Nessus	Rocky Linux Local Security Checks	medium
167457	NewStart CGSL MAIN 6.02 : binutils Multiple Vulnerabilities (NS-SA-2022-0087)	Nessus	NewStart CGSL Local Security Checks	high
164113	GLSA-202208-30 : GNU Binutils: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
159175	SUSE SLES15 Security Update : binutils (SUSE-SU-2022:0934-1)	Nessus	SuSE Local Security Checks	high
157479	AlmaLinux 8 : binutils (ALSA-2021:4364)	Nessus	Alma Linux Local Security Checks	medium
155427	Oracle Linux 8 : binutils (ELSA-2021-4364)	Nessus	Oracle Linux Local Security Checks	medium
155362	openSUSE 15 Security Update : binutils (openSUSE-SU-2021:1475-1)	Nessus	SuSE Local Security Checks	high
155198	CentOS 8 : binutils (CESA-2021:4364)	Nessus	CentOS Local Security Checks	medium
155155	RHEL 8 : binutils (RHSA-2021:4364)	Nessus	Red Hat Local Security Checks	medium
154921	SUSE SLED15 / SLES15 Security Update : binutils (SUSE-SU-2021:3616-1)	Nessus	SuSE Local Security Checks	medium
154898	openSUSE 15 Security Update : binutils (openSUSE-SU-2021:3616-1)	Nessus	SuSE Local Security Checks	medium
154861	SUSE SLED12 / SLES12 Security Update : binutils (SUSE-SU-2021:3593-1)	Nessus	SuSE Local Security Checks	high
151241	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-2058)	Nessus	Huawei Local Security Checks	medium
151220	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-2047)	Nessus	Huawei Local Security Checks	medium
151158	EulerOS Virtualization for ARM 64 3.0.6.0 : binutils (EulerOS-SA-2021-2024)	Nessus	Huawei Local Security Checks	medium
151031	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2021-1976)	Nessus	Huawei Local Security Checks	medium
150278	EulerOS Virtualization 2.9.1 : binutils (EulerOS-SA-2021-1964)	Nessus	Huawei Local Security Checks	medium
150249	EulerOS Virtualization 2.9.0 : binutils (EulerOS-SA-2021-1974)	Nessus	Huawei Local Security Checks	medium
146277	Fedora 33 : mingw-binutils (2021-354441fcdd)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2021-20197

medium

Tenable Plugins

high

critical

critical

critical

critical

medium

medium

high

high

high

medium

medium

high

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium