Integer overflow in Binutils - CVE-2018-7568
Published: March 14, 2018
Vulnerability identifier: #VU11089
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-7568
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists in the parse_die function that is defined in the dwarf1.c source code file due to the improper processing of crafted Executable and Linkable Format (ELF) files that contain corrupted dwarf1 debug information. A remote attacker can send a specially crafted ELF file, trick the victim into opening it, trigger integer overflow and cause the service to crash.
The weakness exists in the parse_die function that is defined in the dwarf1.c source code file due to the improper processing of crafted Executable and Linkable Format (ELF) files that contain corrupted dwarf1 debug information. A remote attacker can send a specially crafted ELF file, trick the victim into opening it, trigger integer overflow and cause the service to crash.
Affected software
Binutils
Gentoo Linux
binutils (Alpine package)
Gentoo Linux
binutils (Alpine package)
How to mitigate CVE-2018-7568
Install update from vendor's website.
binutils (Alpine package) - update to 2.30-r2