An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.

An update of the binutils package has been released.

An update of the gdb package has been released.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD)     library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with     an unbounded loop that increases the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address     exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy     copying private info with _bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c. (CVE-2018-10534)

  - The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab     entry with a 'SECTION' type that has a '0' value, which allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.
    (CVE-2018-10535)

  - Rejected reason: Non Security Issue. See the binutils security policy for more details,     https://sourceware.org/cgit/binutils-gdb/tree/binutils/SECURITY.txt (CVE-2021-3487)

  - An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this     flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in     some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system     availability. (CVE-2021-3549)

  - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It     permits the visual reordering of characters via control sequences, which can be used to craft source code     that renders different logic than the logical ordering of tokens ingested by compilers and interpreters.
    Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted     vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the     following alternative approach to presenting this concern. An issue is noted in the nature of     international text that can affect applications that implement support for The Unicode Standard and the     Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-     right and right-to-left characters, the visual order of tokens may be different from their logical order.
    Additionally, control characters needed to fully support the requirements of bidirectional text can     further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such     that the ordering of tokens perceived by human reviewers does not match what will be processed by a     compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its     document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also     provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode     Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the     BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading     visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.
    (CVE-2021-42574)

  - stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of     service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-     of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699. (CVE-2021-45078)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202208-30 (GNU Binutils: Multiple Vulnerabilities)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

  - A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using     readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary     data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and     availability. (CVE-2021-20294)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

  - A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in GNU     Binutils version 2.36. A crafted symbol can cause stack memory to be exhausted leading to a crash.
    (CVE-2021-3530)

  - An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this     flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in     some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system     availability. (CVE-2021-3549)

  - stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of     service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-     of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699. (CVE-2021-45078)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the binutils packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this     flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in     some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system     availability. (CVE-2021-3549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be     processed by the objdump program could cause a null pointer dereference. The greatest threat from this     flaw is to application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35495)

  - There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to     2.34. (CVE-2020-35496)

  - There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which     could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL     pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

  - An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this     flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in     some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system     availability. (CVE-2021-3549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this     flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in     some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system     availability. (CVE-2021-3549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this     flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in     some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system     availability. (CVE-2021-3549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this     flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in     some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system     availability. (CVE-2021-3549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
204325	Photon OS 4.0: Binutils PHSA-2023-4.0-0460	Nessus	PhotonOS Local Security Checks	high
204288	Photon OS 4.0: Gdb PHSA-2023-4.0-0440	Nessus	PhotonOS Local Security Checks	high
204035	Photon OS 3.0: Gdb PHSA-2023-3.0-0637	Nessus	PhotonOS Local Security Checks	high
170797	EulerOS Virtualization 3.0.2.2 : binutils (EulerOS-SA-2023-1245)	Nessus	Huawei Local Security Checks	high
164113	GLSA-202208-30 : GNU Binutils: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
157991	EulerOS Virtualization 3.0.6.0 : binutils (EulerOS-SA-2022-1056)	Nessus	Huawei Local Security Checks	high
157959	EulerOS Virtualization 3.0.6.6 : binutils (EulerOS-SA-2022-1110)	Nessus	Huawei Local Security Checks	high
156515	EulerOS Virtualization 3.0.2.6 : binutils (EulerOS-SA-2021-2903)	Nessus	Huawei Local Security Checks	high
156360	EulerOS Virtualization 3.0.2.0 : binutils (EulerOS-SA-2021-2837)	Nessus	Huawei Local Security Checks	high
155518	EulerOS Virtualization 2.9.1 : binutils (EulerOS-SA-2021-2750)	Nessus	Huawei Local Security Checks	high
155486	EulerOS Virtualization 2.9.0 : binutils (EulerOS-SA-2021-2793)	Nessus	Huawei Local Security Checks	high
153760	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-2521)	Nessus	Huawei Local Security Checks	high
153717	EulerOS 2.0 SP5 : binutils (EulerOS-SA-2021-2493)	Nessus	Huawei Local Security Checks	high
153712	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-2545)	Nessus	Huawei Local Security Checks	high
153628	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2021-2455)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2021-3549

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high