Memory corruption in Binutils - CVE-2018-18309
Published: October 15, 2018 / Updated: March 23, 2022
Vulnerability identifier: #VU15370
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-18309
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to cause DoS condition on the target system.
The vulnerability exists due to invalid memory address dereference in the read_relocfunction, as defined in the reloc.c source code after boundary error in the _bfd_clear_contents function. A local attacker can submit malicious input using the objdump command, trigger a segmentation fault and cause the affected application to crash.
Affected software
Binutils
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
How to mitigate CVE-2018-18309
Install update from vendor's website.
Binutils - update to 2.32
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014